Executives want a compliance scorecard for each department. What should be the system of record for those percentages?
Select an answer to reveal the explanation.
Short Explanation
Scorecards should be gradebooks calculated from real tests—not numbers someone typed into a slide the night before. Roll up from control results so the percentage matches evidence in the system.
Full Explanation
Executives wanting a compliance scorecard for each department should treat derived compliance posture rolled up from control test results in IRM as the system of record for those percentages. Manually typed percentages in a slide deck updated before each meeting drift, cannot be traced to evidence, and invite political editing. Guessed RAG colors stored only on the authority document header do not reflect entity-level testing across departments. Software license reconciliation counts from SAM measure entitlement, not control effectiveness, and belong to a different domain. Exam caveat: rollup rules and scope filters must be agreed in writing—denominators that quietly exclude failing entities will flatter department scores and later embarrass leadership. Operational check: configure department entity hierarchy, ensure controls and tests link correctly, publish a department scorecard from IRM data, reconcile a sample department to underlying tests with the department steward, and retire slide-deck typing as authoritative. Re-validate rollup logic after reorgs so municipal executives still see trustworthy department percentages tied to live control results and retained evidence in the system of record.