Controls and risks must attach to something durable in the IRM architecture. What is the architectural join point between organizational objects and GRC content?
Select an answer to reveal the explanation.
Short Explanation
Entities are the coat hooks on the wall. Controls and risks hang on the hook—not on a random wiring diagram or a spreadsheet in someone's drawer. No hook, no hanging place.
Full Explanation
In ServiceNow IRM, the entity (historically profile) is the architectural join point linking organizational or technical objects to GRC content such as controls and risks. Item generation and assessments operate against entities, not against a raw CMDB relationship diagram alone, a temporary spreadsheet pasted into a knowledge article each quarter, or the MID Server selection used for Discovery schedules. Entities are the coat hooks on the wall: controls and risks hang on the hook. Without that durable join point, a municipal program cannot consistently scope, own, attest, or report. Relying only on CMDB relationship diagrams leaves GRC without first-class work items. Spreadsheet snapshots drift immediately and fail workflow routing. MID Server choices affect Discovery logistics, not GRC content attachment. Exam caveat: entities often source from CMDB, but the governable object in IRM is the entity record—design workshops must not stop at CMDB topology. Operational check: pick one critical municipal application, ensure its entity exists with ownership, associate a control objective and risk statement, run generation, and verify controls and risks land on that entity for the named owner. Diagram the join point on the city's IRM blueprint and use it in onboarding so teams stop proposing spreadsheet or Discovery-schedule substitutes for entities.