A risk statement is associated to hospital entity types so each in-scope entity receives a risk to assess. What parallel architecture behavior applies?
Select an answer to reveal the explanation.
Short Explanation
Same bakery, different pastry. Risk statements are the recipes; generation puts a risk on each scoped entity—just like controls from control objectives. Parallel pattern, risk flavor.
Full Explanation
Item generation creates risks on entities from scoped risk statements, parallel to control generation from control objectives. When a risk statement is associated to hospital entity types so each in-scope entity receives a risk to assess, that definition-to-instance behavior is the correct architecture pattern. Risks do not appear only after Audit closes the fiscal year, nor do risk statements generate change requests instead of risk records. Association is not merely informational with no entity-level risks—configured generation produces assessable risk records for civic risk programs. The bakery metaphor holds: same pattern as controls, risk flavor. Exam caveat: parallel patterns still need distinct content quality—copying control text into risk statements without risk context fails risk methodology even if generation runs successfully. Operational check: associate a risk statement to a hospital entity type, generate risks, confirm assessment tasks route to owners, compare the pattern to control generation in training materials for civic risk analysts, and verify residual scoring fields are usable for leadership dashboards. Keep risk and control generation both visible on the IRM architecture diagram so new analysts do not treat association as documentation-only.