A utility’s IRM reference architecture must support continuous monitoring, not only periodic questionnaires. Where should indicator hooks sit in the entity-centric model?
Select an answer to reveal the explanation.
Short Explanation
Continuous monitoring is just a heartbeat on the same map—pulse the entity and its controls, not a random spreadsheet on the side. Hang indicators on those objects so a red signal means something concrete. Detached dashboards look pretty and still leave owners guessing what failed.
Full Explanation
In an entity-centric IRM architecture, indicators belong with the entities and controls they monitor so continuous monitoring results stay actionable within the same governable objects used for attestations and issues. A utility reference architecture that must support continuous monitoring—not only periodic questionnaires—should therefore attach indicator hooks to entities and controls. Parking monitoring only in a disconnected BI warehouse that never references entities or controls forces analysts to swivel-chair evidence and breaks closed-loop remediation in ServiceNow. Capturing signals only as free-text on unrelated Incident tickets with no entity link cannot sustain GRC continuous monitoring or compliance scorecards. Placing indicators exclusively on retired authority documents that no longer scope active entities points monitoring at obsolete library content instead of live civic systems. Exam caveat: indicators complement—not always replace—human attestation where judgment is required; architecture should allow both patterns on the same control where appropriate. Operational check: attach a pilot indicator to a utility control on a critical entity, validate result flow into compliance posture, confirm owners see failures in IRM rather than only in a warehouse, document indicator-to-control mapping in the municipal monitoring design, and review quarterly that indicators still reference active entities and controls after type or content changes.