Policy, Risk, and Audit teams each need to see the same hospital EHR entity rather than three conflicting copies. What architecture principle applies?
Select an answer to reveal the explanation.
Short Explanation
One hospital EHR shouldn't wear three name tags. Shared entity framework means Policy, Risk, and Audit point at the same object. Clones start arguments; one entity starts conversations.
Full Explanation
ServiceNow IRM provides a shared entity framework consumed by Policy and Compliance, Risk, and Audit capabilities. A hospital EHR—or any civic critical system—should appear once so those teams govern the same organizational object rather than three conflicting copies. One shared entity enables consistent scoping, ownership, and cross-application reporting. Giving each GRC application a private clone of every entity with divergent names starts arguments and dual masters. Allowing Audit to invent entities that Risk and Policy must never reference breaks program coherence and examiner narratives. Storing entities only in a department SharePoint list synchronized weekly recreates an external shadow system of record outside workflow and generation. Exam caveat: shared entities still require clear ownership, roles, and access control so every team can use them without unauthorized structural edits. Operational check: confirm one EHR entity is referenced from policy controls, risk assessments, and audit engagements; prohibit per-application clones in design standards; demonstrate a cross-application report for hospital or city leadership; and document the shared-framework principle in the IRM charter signed by Policy, Risk, and Audit leads.