A major EHR upgrade is scheduled that changes authentication and data flows. What lifecycle action should the risk team take for related risks?
Select an answer to reveal the explanation.
Short Explanation
Big EHR surgery changes the patient. Put a reassessment on the calendar after the upgrade so yesterday's scores are not today's fiction.
Full Explanation
When a major EHR upgrade changes authentication and data flows, related risks should be scheduled for reassessment after the upgrade. Lifecycle reassessment keeps hospital risk scores aligned with the new operating reality for patient systems. Freezing all risk records permanently so scores never change fails by concept because static scores drift from truth after material change. Waiting five years regardless of the upgrade fails by concept because major technology change is an event-driven reassessment trigger. Deleting related risks the day before the upgrade to declutter fails by concept because deletion destroys continuity and hides transitional exposure. Exam caveat: CIS-RC expects event-driven reassessment after significant changes affecting risk factors. Operational check: identify risks tied to the EHR authentication and data-flow changes, schedule post-upgrade reassessment tasks, complete inherent and residual updates after go-live, and present revised scores to the risk committee. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.