Executives want a compliance scorecard for each department. What should be the system of record for those percentages?
Select an answer to reveal the explanation.
Short Explanation
Scorecards should be gradebooks calculated from real tests—not numbers someone typed into a slide the night before. Roll up from control results so the percentage matches evidence in the system.
Full Explanation
Compliance scorecards in an IRM architecture should derive from control results (and related posture calculations), not from manually entered presentation figures as the system of record. Derived rollups keep executive views aligned with tested controls and issues. Manual RAG typing and unrelated SAM metrics do not represent Policy and Compliance posture.