The audit finding reveals a systemic failure in data management that poses a significant risk to regulatory compliance. The most appropriate first strategic action is to establish a data governance framework. This framework provides the foundational structure, principles, policies, standards, and defined roles and responsibilities required to manage data as a critical enterprise asset. It addresses the root cause of the problem by creating an organized and accountable approach to data management, ensuring it aligns with strategic objectives such as regulatory reporting. The other options are tactical components that would be developed and implemented within this overarching framework.

B. Assigning data responsibilities through a RACI chart is a tactical activity that defines roles. This is an important step, but it should occur within an established governance framework.
C. Reviewing key risk indicators (KRIs) is a monitoring activity. The audit has already identified a significant issue; the immediate need is for a strategic corrective action, not further measurement.
D. Updating data management policies is a necessary action, but policies are only one component of a governance framework. Without the complete framework, policies may lack enforcement and accountability.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 1: Governance of Enterprise IT

Task 1.3

emphasizes the need to establish and maintain a governance framework as the foundation for aligning IT with enterprise objectives. The scenario described is a clear misalignment that a proper framework is designed to prevent and correct.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective APO14 Managed Data explicitly lists as a key practice "APO14.01 Establish a data governance framework." This practice is foundational to defining data-related roles

responsibilities

and processes to meet business and compliance requirements.

3. Abraham

R.

Schneider

J.

& vom Brocke

J. (2019). Data governance: A conceptual framework

structured review

and research agenda. International Journal of Information Management

49

424-438. https://doi.org/10.1016/j.ijinfomgt.2019.07.008. This academic review (Section 3.1) defines a data governance framework as the primary structure encompassing policies

standards

and roles

confirming it as the strategic starting point for addressing systemic data management issues.