CRISC: Certified in Risk and Information Systems Control

A productivity impact created by a control required for regulatory compliance should be escalated to senior management so it can be evaluated against the organization’s compliance obligations, risk exposure, and business objectives. Management can authorize or sponsor a compliant redesign or other appropriate response; the control should not simply be removed.