A hospital access-review KRI must show whether privileged AD groups still match approved membership. Where should those membership signals feed?
Select an answer to reveal the explanation.
Short Explanation
Who's in the privileged club is a signal — park it on an indicator that watches group membership. Annual paper charts, HR cases, or SAM licenses are the wrong mailboxes for that KRI.
Full Explanation
A hospital access-review KRI that must show whether privileged AD groups still match approved membership should feed those membership signals into an IRM indicator that consumes identity-group membership data for the access-review measure. Indicators are the correct IRM object for ongoing access-governance signals on civic clinical identity risk. The mailbox for the signal is the indicator, not adjacent product silos.
Parking the signal only in a printed org chart updated annually with no indicator record provides no continuous measure. Feeding solely into CIS-HR case types as the authoritative access-review control misroutes continuous membership monitoring into HR casework. Using SAM license reconciliation as a substitute confuses software entitlement with access governance.
Exam caveat: identity membership KRIs belong on IRM indicators. HR cases and SAM recon are different domains.
Operational check: configure an indicator sourced from privileged group membership vs approved lists; attach to the access-review risk or control; alert on drift; do not rely on annual org-chart prints.
Indicator evaluation should flag both missing approved members and unexpected privileged members, because both are access-review failures for clinical systems. Retain history of membership drift for audit sampling and avoid annual printed org charts as the control measure.