After three related water-main outages, a municipal GRC team wants the pattern tracked as a managed risk in IRM—not only as closed incidents. What intake path should they use?
Select an answer to reveal the explanation.
Short Explanation
Incidents are smoke; the risk register is the fire map. Spot the trend, grab (or write) a risk statement, then create the scoped risk on the right entity. A knowledge article or a random change ticket is not the IRM lifecycle.
Full Explanation
After related water-main outages, a municipal GRC team should identify the exposure, author or reuse a risk statement, then generate a scoped risk instance for the water utility entity so the pattern is managed as risk—not only as closed incidents. Incidents close; unmanaged recurring exposure needs a register home. Creating only a knowledge article and skipping the risk register fails by concept because articles inform; they do not score, own, or treat risk. Opening a change request template as the enterprise risk record fails by concept because change tickets are not risk register instances. Raising a single audit engagement and treating findings as a permanent risk substitute fails by concept because audit engagements are time-boxed assurance, not ongoing risk management. Exam caveat: CIS-RC intakes recurring operational patterns via risk statement to scoped risk, distinct from incidents, changes, and audits. Operational check: author or reuse a water-main outage risk statement, scope it to the water utility entity, assign an owner, and link related incident references without substituting those incidents for the risk record. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.