Quarterly control testing is due for an active ERP access control. What Policy and Compliance lifecycle activity should the owner perform?
Select an answer to reveal the explanation.
Short Explanation
When the calendar says quarterly test, actually run the test and park the result on the control. That’s the compliance heartbeat—evidence, not vibes. Retiring the mandate or deleting scope just to dodge the queue is the opposite of a lifecycle.
Full Explanation
The compliance lifecycle includes performing control tests and recording results against the control. When quarterly testing is due for an active ERP access control, the owner should create and perform a control test and record the result against that control. Those results feed effectiveness reporting and may trigger issues on failure for civic programs that must show examiners a living test history. Retiring the authority document to skip testing for the quarter is an inappropriate lifecycle shortcut that damages the mandate library and future mapping. Converting the control into an unrelated incident without a test record loses compliance evidence structure and mixes ITSM noise with GRC proof. Removing entity scope so the control disappears from the queue hides work rather than completing it and corrupts scope integrity. Exam caveat: test quality matters—recording a result without appropriate evidence still fails examiner scrutiny even if the UI shows complete. Operational check: open the ERP control's test activity, execute the defined procedure, attach evidence, save the result, verify dashboards update for the city's compliance scorecard, and sample failed-path behavior in subprod so owners know issue creation follows documented procedures.