A housing authority's internal audit finds that an AI tool used to screen rental applications has been operating for months without ever completing its required access-control review. Enterprise risk leadership must decide how to respond. What is the appropriate response?
Select an answer to reveal the explanation.
Short Explanation
Think of an access-control review like a background check for a new hire handling sensitive files: you wouldn't let someone start moving money before that check clears. A tool touching applicants' personal data without a completed review is running with the same kind of gap, and the safe move is to pause it, not just write it down for later.
Full Explanation
An access-control review verifies who and what can reach sensitive data, in this case applicant personal and financial information used for rental screening, and confirms those permissions match policy before a tool is trusted to run unsupervised. When that review never happened, the organization has no verified assurance that access is appropriately restricted, which means every day of continued operation is uncontrolled exposure, not a documented-but-tolerable gap. Suspending or restricting access until the review completes treats the missing control as the enterprise risk it is, converting an unverified assumption into a confirmed safeguard before applicants' data is touched again. Logging the gap and scheduling a future review defers the fix while the exposure continues in the meantime, which is a paperwork response to a live risk. Accepting a vendor's self-certification substitutes an external party's claim for the organization's own verification, and a contractual promise is not the same thing as a completed review. Quietly notifying security without changing the tool's operating status leaves the underlying gap open. Scope note: continuity needs may justify a documented, time-boxed exception with compensating controls, but that is a deliberate risk-acceptance decision, not silent continuation. Operational check: confirm the review is scheduled with an owner and a hard completion date before any exception is granted.