A water utility is standing up IRM for operational technology risks and staff want to jump straight into writing individual risk records. What should come first?

Standing up IRM for operational technology risks at a water utility should begin by creating a risk framework for OT risks as the organizing container before authoring individual risk statements. The framework defines categories and methodology so civic OT risk content stays coherent. Creating random risk records with no framework fails by concept because unconstrained scoring and orphan statements cannot be compared or governed consistently. Skipping structure and importing every past audit finding as an orphan risk fails by concept because findings are inputs; they are not a substitute for framework-organized risk content. Configuring only Advanced Audit engagements and ignoring risk content fails by concept because audit engagements assess; they do not replace the risk register architecture for OT. Exam caveat: CIS-RC Risk starts with a risk framework container before mass authoring of statements and instances. Operational check: create an OT risk framework with methodology and categories, then author a pilot risk statement under that framework and scope it to a sample OT entity before bulk loading historical findings. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.