A state department of transportation wants internal audit to plan engagements from a living risk register. Which use-case approach fits IRM?
Select an answer to reveal the explanation.
Short Explanation
If audit wants a living risk register, put Audit and Risk on the same IRM data—not a lonely spreadsheet universe. Shared entities and risks let engagement planning follow where the heat actually is. That is risk-based audit on the platform, not side-channel planning.
Full Explanation
A state department of transportation that wants internal audit to plan engagements from a living risk register should plan an Audit plus Risk integrated use case so engagements draw from shared IRM risk data. Shared entities and risks let engagement planning follow where heat actually is across roads, systems, and facilities, instead of a lonely spreadsheet audit universe. That is risk-based audit on the platform with traceability back to assessed civic assets and clear owners. Integration also reduces duplicate inventories that auditors and risk managers maintain in parallel. Keeping the audit universe only in a disconnected spreadsheet and ignoring the IRM risk register recreates the parallel paper world IRM should retire. Building engagements solely from ITSM change calendars without risk data plans work from change volume, not risk posture. Using Vulnerability Response groups as the only input to engagement planning narrows assurance to vuln queues and misses broader IRM risk. Exam caveat: integrated Risk and Audit planning on common GRC data is the intended pattern. Operational check for DOT audit: connect engagement planning to IRM risk records for in-scope entities, select a sample of high residual risks for the next plan, reconcile owners, and retire the spreadsheet universe for those entities after validation.