One control objective for backup verification is scoped to five clinic entities. What must generation create?
Select an answer to reveal the explanation.
Short Explanation
One recipe, five kitchens—five cakes. Generation should mint a distinct control for each clinic entity so ownership and testing stay local. A comment listing five names is not five controls.
Full Explanation
When one control objective for backup verification is scoped to five clinic entities, generation must create distinct controls per clinic entity, each with its own lifecycle and ownership. Entity-centric IRM exists so local evidence, failures, and remediation stay attached to the right civic clinic. A single shared control record that lists all five clinics in a comment field cannot route authentic ownership or preserve entity-level history. Five duplicate control objectives instead of entity-level controls misuse the definition layer and multiply library maintenance. One enterprise risk statement with no compliance controls answers a risk problem, not the compliance generation question asked. Exam caveat: identical procedures across clinics still deserve separate control instances; sameness of procedure is not sameness of accountability. Operational check: scope the objective to the five entities or their type filter, run generation, confirm five controls with clinic-specific owners, perform a test on one clinic without affecting others' status, and show entity-sliced reporting to health leadership. Reject comment-field multi-entity hacks in design review as non-compliant with entity-centric IRM architecture used by the municipal health program.