Watch this video on YouTube
If internal audit reports several information security issues not in compliance with regulatory requirements, what should the information security manager do first?