A water utility is standing up IRM for operational technology risks and staff want to jump straight into writing individual risk records. What should come first?
Select an answer to reveal the explanation.
Short Explanation
Do not scatter sticky notes before you buy the corkboard. Stand up the risk framework for OT first, then write statements that hang on that structure.
Full Explanation
In Risk and Advanced Risk, a risk framework is the organizing lifecycle container for categories, scoring, and statements. Creating it before individual statements keeps the register coherent. Random orphan risks or jumping to audit-only configuration skips the Risk architecture the exam expects.