Leadership wants compliance status both by business entity and by authority document. What does the data model need?
Select an answer to reveal the explanation.
Short Explanation
You need to slice the same pie two ways—by department and by regulation. That only works if controls sit on relationships to both entities and authority citations. Orphaned notes cannot feed either report.
Full Explanation
Compliance reporting commonly requires dual axes: posture by entity and posture by authority document or citation. The architecture therefore needs intact relationships from controls through objectives, citations, and entity scoping. Those links let one control population support both cuts. Flat unstructured notes or split instances cannot produce consistent dual-axis scorecards.