A mayor demands that “everything” be scored for risk and compliance by Friday. What guidance should the IRM lead give?
Select an answer to reveal the explanation.
Short Explanation
“Score everything by Friday” sounds decisive and usually delivers garbage. Bad scope plus fake urgency equals colorful charts nobody owns. Push back gently: a clean critical population scored well beats a citywide dump scored by nobody.
Full Explanation
Credible IRM results depend on accurate entity populations, ownership, and assessable controls. Forcing every object into scope without data readiness creates unowned assessments, noisy issues, and executive metrics that cannot be defended. Leaders should sequence high-impact populations and communicate that quality of scope outranks calendar theatrics. Speed-to-everywhere is a recognized anti-pattern in IRM rollouts.