Before any IRM configuration, a program manager skips stakeholder mapping. Which checklist action should happen first?
Select an answer to reveal the explanation.
Short Explanation
Configuration without owners is a ghost town—forms exist, but nobody answers when attestation day hits. The checklist starts by naming policy, control, risk, and audit stakeholders. Map the people before you map the tables.
Full Explanation
Before IRM configuration, the program must identify policy owners, control owners, risk owners, and audit stakeholders. Skipping stakeholder mapping produces a ghost town after go-live: forms exist, but nobody answers when attestation day hits for civic services. Checklists start with people and decision rights, then tables and workflows, because unowned controls and risks will not be maintained. Named humans also clarify lines of defense and prevent defaulting everything to the audit team or to IT administrators. Activating every plugin and assigning GRC admin to all IT staff immediately creates privilege sprawl without named business owners. Generating controls for every CI in the CMDB without named owners industrializes orphaned work and unread queues. Publishing dashboards to the public internet for transparency before naming owners exposes incomplete posture and still leaves work unowned. Exam caveat: persona identification precedes configuration on implementation checklists. Operational check for the program manager: complete a stakeholder matrix with named humans for policy, control, risk, and audit roles for the phase-one scope, obtain sign-off, and only then authorize entity generation and attestation scheduling.