Several control tests fail across departments in a state agency. Where should remediation converge architecturally?
Select an answer to reveal the explanation.
Short Explanation
When tests fail, everyone should meet at the same repair desk—the issue. Shared issue management is the funnel from failed compliance work into owners, due dates, and closure. Spreadsheets and renaming entities just hide the mess.
Full Explanation
When several control tests fail across departments in a state agency, remediation should converge on shared issue management records that track remediation from failed tests. That shared issue layer gives leadership a portfolio view, consistent due dates, and closed-loop linkage back to controls. Separate private spreadsheets owned by each department with no IRM link recreate shadow trackers, hide cross-department themes, and break examiner traceability. Authoring new authority documents for every failure misuses the mandate library as a ticket system and pollutes content. Renaming entity classes to hide failing entities from reports is concealment, not remediation, and destroys taxonomy trust. Exam caveat: shared issues still need clear ownership and due dates—central visibility without accountability stalls and creates aging queues. Operational check: confirm failed tests create issues, assign department owners, roll up open issues for agency leadership, link remediations back to controls, and require retest on closure. Prohibit spreadsheet-only remediation for in-scope failures in the agency's compliance SOP, sample closed issues for missing retest evidence each month, and escalate chronic aging to executives.