A GRC admin needs overdue control-test owners at a school district to get email notifications without writing a scripted application. Which platform capability fits at configuration depth?
Select an answer to reveal the explanation.
Short Explanation
Overdue tests need a nudge, not a custom app. A light Flow Designer notification to owners does the job. Script-only mandates or hoping people remember are the extremes to avoid.
Full Explanation
Overdue control-test owners at a school district should receive email notifications via Flow Designer (or equivalent flow) configured lightly—without writing a scripted application. Configuration-depth automation fits CIS-RC: notify on overdue state transitions using platform flow tools. Civic compliance programs need nudges that are maintainable by GRC admins.
Mandating CAD-level Script Includes as the only supported notification path overstates required depth and slows operations. Disabling all notifications and relying on owners to remember quarterly deadlines fails predictably. Moving every overdue test into a CIS-HR employee case automatically misroutes compliance testing into HR case management.
Exam caveat: Flow Designer notifications are in-scope configuration; Script Includes are not required for this purpose; HR cases are the wrong container.
Operational check: build a flow on control-test overdue; send owner email; test with a deliberately overdue sample; avoid Script Include-only mandates for this notification.
Flow notifications should include test name, entity, due date, and link, with escalation to the owner’s manager after a defined overdue period. Keep the automation at flow configuration depth so school-district GRC admins can maintain it without Script Include mandates.