Which step should you take first when faced with a compliance risk?

• A. Identify the risk
• B. Apply policy
• C. Consult stakeholders
• D. Document the outcome

Answer: (A)

Identifying the risk first is essential because you need a clear picture of what might go wrong before you can do anything else effectively. When you define the specific compliance risk—what could fail, where it could happen, and which laws or policies it touches—you establish the facts, scope, and potential impact. That foundation lets you tailor controls that really address the issue, allocate resources sensibly, and determine how urgent the response should be.

If you jump straight to applying a policy, you might lock in rules that don’t fit the real problem, leaving gaps or creating unnecessary burden. Consulting stakeholders is important for insight, but it’s most useful after you’ve pinpointed the risk so the discussion can focus on the right concerns. Documenting the outcome matters for accountability, yet it should summarize actions taken in response to an identified risk, not replace the initial step of defining what the risk is.

So, begin by identifying the risk to set up a targeted, effective, and compliant response.