A balanced scorecard is a tool that helps to measure and communicate the value of IT initiatives to the board of directors. It aligns IT objectives with business goals, tracks performance indicators, and shows the contribution of IT to the enterprise value. A balanced scorecard can also help to identify gaps and areas for improvement in IT governance. References := CGEIT Review Manual, 7th Edition, Chapter 3: Benefits Realization, Section 3.3: Value Delivery Frameworks and Mechanisms, pp. 103-105.

The first course of action for the CIO of a financial services company to ensure IT processes are in compliance with recently instituted regulatory changes should be to perform a current state assessment. This is because a current state assessment can help to evaluate the existing IT processes, policies, controls, and performance against the new regulatory requirements and identify any gaps, issues, or risks that need to be addressed. A current state assessment can also help to establish a baseline and a benchmark for measuring the progress and effectiveness of the compliance initiatives.
Aligning IT project portfolio with regulatory requirements is not the first course of action, as it is a subsequent step after performing a current state assessment. Aligning IT project portfolio with regulatory requirements can help to prioritize and allocate resources for the IT projects that support the compliance objectives and deliver value to the business. However, aligning IT project portfolio with regulatory requirements requires a clear understanding of the current state and the desired state of the IT processes and compliance.
Creating an IT balanced scorecard is not the first course of action, as it is a tool for monitoring and reporting the compliance outcomes and impacts. An IT balanced scorecard is a framework that measures and communicates the performance of the IT function in terms of financial, customer, internal process, and learning and growth perspectives. An IT balanced scorecard can help to align the IT strategy with the business strategy, track the progress and results of the IT initiatives, and demonstrate the value and contribution of IT to the business. However, creating an IT balanced scorecard does not provide a comprehensive analysis or improvement plan for the IT processes and compliance.
Identifying the penalties for noncompliance is not the first course of action, as it is only a motivation factor for compliance. Identifying the penalties for noncompliance can help to raise awareness and urgency of the compliance issues and risks, as well as deter or prevent violations or breaches. However, identifying the penalties for noncompliance does not provide a detailed assessment or guidance for achieving compliance.
References := IT Compliance: What You Need to Know | Smartsheet, How to Achieve Compliance section. IT Compliance Management Best Practices: 5 Tips from Experts - MetricStream, Tip 1: Assess your current state section. IT Compliance Checklist: How to Ensure Your Business Is Compliant - Blissfully, Step
1: Assess Your Current State section. IT Compliance Management - Definition & Overview | OpsCompass, How Do You Manage IT Compliance? section.

The number of events impacting business processes due to delays in responding to risks is the best outcome measure to determine the effectiveness of IT risk management processes, because it reflects the actual consequences and losses that result from inadequate or ineffective riskmanagement. Outcome measures are metrics that evaluate the results and benefits of a process or activity, rather than the inputs or outputs1. Outcome measures help to assess whether the process or activity is achieving its objectives and delivering value to the organization1. The number of events impacting business processes due to delays in responding to risks is an outcome measure that indicates how well the IT risk management processes are able to identify, analyze, evaluate, treat, monitor, and communicate IT risks in a timely and appropriate manner. A high number of such events would suggest that the IT risk management processes are not effective, and that they need to be improved or revised. A low number of such events would suggest that the IT risk management processes are effective, and that they are reducing the likelihood and impact of IT risks on the organization.
References := How To Measure Risk Management KPI & Metrics - ERM Software

After receiving recommendations, thefirst logical step is to evaluate the feasibility-this includes assessing alignment with strategic goals, resource availability, risk tolerance, and operational impact.
Implementing or planning without a feasibility assessment may result in impractical or misaligned actions.
Reference:
CGEIT Review Manual: Domain 1 - Governance of Enterprise IT
COBIT 2019: EDM02 (Ensure Benefits Delivery), APO02 (Manage Strategy).

Increasing the maturity of IT process from being ad hoc to being repeatable means that the process is documented and followed consistently, resulting in more predictable and reliable outcomes. According to the capability maturity model for the IT governance process, a repeatable level indicates that "required outcomes are more frequently achieved" 1. References: CGEIT Domain 1: Framework for the Governance of Enterprise IT