Exam CRISC topic 1 question 1636 discussion

When a conflict exists between an organization’s internal policy and local privacy regulations, the BEST course of action is to: Seek a policy exception from senior management to comply with the local law. Ensure that the organization adjusts its internal policy in a way that respects regulatory requirements while still addressing risk. Document the exception, including the rationale and compensating controls, to maintain governance and accountability. This approach ensures that the company: Respects local laws (which must take precedence), Maintains internal policy integrity with a formal exception process, Avoids unnecessary regulatory exposure or fines.

Requesting a policy exception from senior management is the best approach because it allows the organization to address the specific conflict between its data-handling policy and local privacy regulations while ensuring that senior leadership is aware of and approves the deviation from standard policies. This approach allows the organization to maintain compliance with local regulations without undermining its internal policies.