While conducting an audit of the incident isaca video

Full Certification Question

While conducting an audit of the incident management process of a organization, you observed that organization has failed to notify its customers about a security breach. What should be your first course of action?