Whenever there is a change in sourcing strategy, such as moving from cloud to internal hosting, the first step is to reassess the effectiveness and completeness of existing risk responses and confirm that they still mitigate the risks appropriately.
CRISC emphasizes:
"When transitioning services or changing control environments, practitioners should reassess risk responses and validate that previously identified risks and vulnerabilities remain properly addressed." Only after reassessment should the practitioner proceed to update registers, controls, and audit plans.
Hence, A is the correct answer.
CRISC Reference: Domain 3 - Risk Response and Mitigation, Topic: Managing Control Changes.