A compliance officer identifies a control that mitigates risk but is not explicitly required by any regulation. The cost to maintain the control is high. What should the officer recommend?
-
A
Remove the control immediately to reduce costs
-
B
Conduct a cost-benefit analysis and present findings to leadership for a risk-based decision
-
C
Add the control to the regulatory requirement list
-
D
Transfer the risk to a third party without further analysis