The same access-control fails for a fourth quarter in a row at a public hospital, and remediation keeps slipping. What supporting handoff should compliance make?
Select an answer to reveal the explanation.
Short Explanation
Same fail, fourth quarter — that is not a one-off bug; it is a risk conversation. Hand it to risk so leadership decides appetite instead of living in endless remediation limbo.
Full Explanation
When the same access control fails a fourth consecutive quarter at a public hospital and remediation keeps slipping, compliance should hand the recurring failure to risk for appetite and treatment discussion. Persistent failure is no longer a routine ticket; it is a risk decision about patient-data access exposure. Hiding failures from risk so the register stays quiet fails by concept because silencing risk data falsifies enterprise risk posture. Marking the control permanently effective to stop repeat findings fails by concept because administrative pass stamps do not restore control operation. Transferring ownership to the help desk without risk discussion fails by concept because reassignment without appetite treatment leaves the systemic issue ungoverned. Exam caveat: CIS-RC expects recurring unresolved compliance failures to escalate into risk treatment and appetite conversations. Operational check: document the multi-quarter failure pattern, create or update a related risk for stalled remediation, and schedule risk-committee review of appetite and treatment options before another quarter closes with the same fail. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.