Leadership wants compliance status both by business entity and by authority document. What does the data model need?
Select an answer to reveal the explanation.
Short Explanation
You need to slice the same pie two ways—by department and by regulation. That only works if controls sit on relationships to both entities and authority citations. Orphaned notes cannot feed either report.
Full Explanation
Leadership wanting compliance status both by business entity and by authority document needs relationships that connect controls to entities and to citations or authority documents so both reporting cuts work from the same system of record. Free-text comments on policies with no relational links cannot power either cut reliably when the city scales. A single flat list of controls with no entity or citation relationships fails both dimensions and forces slide-deck mathematics. Separate IRM instances—one for entities and one for regulations—destroy joinability, inflate cost, and invite conflicting percentages. Exam caveat: relationship quality and generation completeness determine report trust—empty maps yield empty slices even if UI widgets exist and look executive-ready. Operational check: validate that sample controls link to entities and to citations, build entity-sliced and authority-sliced scorecards for leadership, reconcile totals to underlying tests, and fix missing maps before publishing numbers externally. Include relationship checks in content QA when new mandates or entities are onboarded to the municipal program, and re-run both cuts after major content pack updates or reorganizations.