A new legal requirement conflicts with the organization's previously accepted practice. What should the risk practitioner do first?

1. Wait for an enforcement action before considering the change
2. Engage qualified owners to confirm applicability and assess the required changes
3. Treat previous risk acceptance as a waiver of law
4. Copy a competitor's policy as proof of compliance