A mayor demands that “everything” be scored for risk and compliance by Friday. What guidance should the IRM lead give?

When a mayor demands that “everything” be scored for risk and compliance by Friday, the IRM lead should protect scope quality because rushed universal inclusion produces unreliable scores and unowned work. Bad scope plus fake urgency equals colorful charts nobody owns and metrics that cannot be defended. A clean critical population scored well beats a citywide dump scored by nobody. Accepting universal inclusion immediately and deferring ownership and data quality indefinitely institutionalizes garbage-in reporting. Turning off entity validation so scores can publish against empty associations falsifies posture. Replacing entity scoping with a single company-wide PowerPoint risk heat map abandons the platform operating model. Exam caveat: quality of scope outranks calendar theatrics; speed-to-everywhere is a known IRM anti-pattern. Operational check for the IRM lead: propose a sequenced critical-population plan with owners and dates, score that set with evidence, and brief the mayor on why universal Friday scoring would be indefensible to auditors. Keep civic stakeholders aligned on the operating model, and verify platform records after each change before reporting posture to leadership. Revisit the design when CMDB classes, org structures, or program charters change.