Converting a proof of concept into a governed production system, the team plans to run its first formal risk assessment only once a regulator requests documentation. What is wrong with this plan?
Select an answer to reveal the explanation.
Short Explanation
If you wait for a regulator to ask, you've already let the risk run loose in production. You need to identify and manage risk before and during deployment, because catching problems early is cheaper and safer.
Full Explanation
The correct option is the one saying risk should be identified proactively before and during deployment, not only in reaction to an external request, because problems are cheaper to catch before they cause harm. Regulatory inquiry is a lagging trigger; ethical and reputational harm, and many operational failures, can occur well before any regulator gets involved, so risk identification needs to happen ahead of and throughout deployment.
The option saying nothing is wrong because regulators are the authoritative source for which risks matter is incorrect. Regulators define compliance obligations, not the full universe of risk; ethical and reputational risks in particular are not something a regulator will necessarily flag.
The option saying the plan is fine as long as the assessment happens quickly once requested is incorrect. Speed after the fact does not recover the harm that may already have occurred while the risk went unassessed.
The option saying the plan is only a problem for regulated industries, and that other sectors can safely wait, is incorrect. Ethical, operational, and reputational risk apply regardless of whether the sector is formally regulated.
For the exam, treat waiting for a regulator to ask as the specific anti-pattern this practice is meant to prevent.