According to the CGEIT exam guide, the organization's risk profile is a representation of the current and potential risks that the organization faces, as well as the likelihood and impact of those risks. The risk profile helps to inform the risk management strategy, policies and processes, as well as the risk appetite and tolerance of the organization. When an enterprise enters into a new market that brings additional regulatory compliance requirements, the first thing that should be done is to update the organization's risk profile to reflect the new sources, types and levels of risk that the enterprise may encounter. This will help to identify and assess the compliance risks, as well as to plan and implement appropriate risk responses and controls. The other options are not the first things that should be done, as they are more related to the execution and monitoring of compliance, rather than the identification and assessment of compliance risks. References: CGEIT Exam Candidate Guide, page 15. CGEIT Certification, How to Develop a Risk Profile