A civic IRM rollout has an authority document, citations, control objectives, generated controls, and open issues—but failed tests never create those issues. Which stage is missing in the chain?
Select an answer to reveal the explanation.
Short Explanation
The story goes mandate → citation → objective → control → test → issue. They built everything except the test that fails into an issue. Without that link, remediation never starts from compliance evidence.
Full Explanation
Policy and Compliance Management’s end-to-end chain is authority document → citation → control objective → control → test/result → issue/remediation. Missing control testing breaks the handoff from design to measured effectiveness and prevents systematic issue creation from failed results. Parallel CMDBs, VRM questionnaires, or SIR playbooks are not substitutes for that PCM stage.