After three related water-main outages, a municipal GRC team wants the pattern tracked as a managed risk in IRM—not only as closed incidents. What intake path should they use?
Select an answer to reveal the explanation.
Short Explanation
Incidents are smoke; the risk register is the fire map. Spot the trend, grab (or write) a risk statement, then create the scoped risk on the right entity. A knowledge article or a random change ticket is not the IRM lifecycle.
Full Explanation
IRM risk identification typically flows from a reusable risk statement to a scoped risk instance on an entity. Incident trends can trigger that intake, but knowledge articles, change templates, or audit engagements alone do not replace statement-to-instance registration and subsequent assessment and response.