An EHR application must have access-review control tests run every three months. What frequency setting should the compliance admin configure on the control?
Select an answer to reveal the explanation.
Short Explanation
Quarterly means the calendar—not a sticky note that says “maybe next month.” Put quarterly on the EHR access-review controls so tests open on schedule. Hoping people skip cycles, waiting for auditors, or forcing annual-plus-exceptions is how reviews go stale.
Full Explanation
Control test frequency defines when compliance tests become due for a control on an entity. For an EHR that must complete access-review testing every three months, configuring quarterly frequency on those controls aligns the Policy and Compliance calendar with clinical access governance expectations for protected health information systems. Setting monthly frequency and relying on testers to skip two of every three cycles fails by concept because informal skipping produces inconsistent evidence, spurious overdue noise, and no reliable attestation of the intended cadence. Disabling scheduled testing and opening ad-hoc tests only when auditors arrive fails by concept because continuous compliance monitoring for civic clinical systems cannot depend on fieldwork presence. Setting annual frequency and marking mid-year reviews as policy exceptions fails by concept because exceptions are for approved deviations, not a substitute for the intended quarterly operating rhythm. Exam caveat: CIS-RC treats configured test frequency as the authoritative schedule—not tribal skip rules or auditor-triggered one-offs. Operational check: open the EHR access-review control, set frequency to quarterly, generate or advance the next test, and confirm the due date is approximately ninety days out with no reliance on manual skip instructions.