A city manager asks which executive outcomes IRM reporting should emphasize beyond IT operations KPIs. What is the best answer?
Select an answer to reveal the explanation.
Short Explanation
City hall cares whether risk is rising, obligations are met, and audits are clean—not just how many tickets closed on Tuesday. IRM dashboards should speak that language.
Full Explanation
Executive IRM reporting should emphasize risk posture, compliance status, and assurance findings that leaders can act on—not only service-desk volume metrics. A city manager needs to know whether exposure is rising, obligations are met, and audits are clean so remediation and investment can be prioritized across civic services. ITSM throughput, SAM license percentages, and SOC alert counts may be adjacent operational signals, but they are not the primary IRM executive narrative. Reporting only mean time to resolve incidents and change success rate keeps leadership in IT operations KPIs and misses GRC outcomes. Reporting only software license compliance from SAM answers entitlement questions, not control and risk posture. Reporting only firewall alert counts from the SOC answers detection volume, not whether policies and controls hold on governed entities. Exam caveat: CIS-RC overview expects executive consumers to see risk, compliance, and assurance views from IRM workspaces and dashboards. Operational check for the city: publish a leadership dashboard with at least risk rating distribution, compliance status for a priority obligation, and open issue or finding counts by entity owner, and confirm the city manager can act from those tiles without opening incident queues.