Leadership wants IRM reporting rollups by Organization, Technology, and Third Party. Which construct should the implementer use to group entity types for hierarchy and reporting?
Select an answer to reveal the explanation.
Short Explanation
Classes are the big binders; types are the tabs inside. Org, Technology, and Third Party as classes let dashboards roll up without cloning the whole instance. Reporting wants structure, not three separate worlds.
Full Explanation
Leadership wanting IRM reporting rollups by Organization, Technology, and Third Party should use entity classes that group related entity types for hierarchy and aggregation. Classes categorize types so executive dashboards can slice residual risk, control posture, and ownership without cloning the ServiceNow instance or inventing parallel taxonomies. Separate instances per rollup category multiply cost and destroy a shared system of record for municipal GRC. Knowledge base categories named after rollup labels do not drive entity hierarchy or item generation rollups. Change request templates duplicated per reporting dimension address ITSM change packaging, not IRM entity aggregation. Exam caveat: classes organize and report—they are not a second filter engine that duplicates entity-type table conditions. Operational check: define stable classes for Organization, Technology, and Third Party; assign each agreed entity type to the correct class; generate sample residual-risk or compliance widgets sliced by class; and confirm city executives can navigate from class rollup to underlying entities. Document class taxonomy in the IRM reference architecture so bureau-level redesigns do not invent ad-hoc rollup dimensions.