Authors upload step-by-step procedure documents that support an internal access policy. How do these differ from authority citations in the content model?
Select an answer to reveal the explanation.
Short Explanation
Procedures are the how-to handbook next to your internal policy; citations are the numbered obligations pulled from a mandate. Don’t swap those labels—auditors care which is which. Procedures support the policy; they aren’t stand-ins for regulatory citations.
Full Explanation
In IRM Policy and Compliance, authority document citations represent discrete external or adopted mandate obligations, while procedures and internal policies support how the organization operates. When authors upload step-by-step procedure documents that support an internal access policy, those procedures differ from authority citations: they explain operating methods, not the external obligation records themselves. Treating procedures as identical to citations that should replace authority documents entirely collapses layers and loses regulatory lineage. Claiming citations are only for ITSM knowledge articles and never map to control objectives is false. Storing procedure documents as entity classes to generate risks automatically confuses content types with entity taxonomy. Exam caveat: procedures can evidence how a control is performed, but they do not replace citations or control objectives in the mandate chain. Operational check: file procedures as supporting policy content linked to the internal access policy, keep citations under the relevant authority documents, map citations to control objectives, and show examiners both the mandate lineage and the municipal procedure used during testing. Review linkage after policy updates so procedures do not drift from approved wording.