A city manager wants the board pack to show cyber, facilities, and workforce risks grouped under the enterprise risk framework—not a flat dump of 200 rows. What IRM practice supports that?
Select an answer to reveal the explanation.
Short Explanation
Boards do not want a phone book of 200 risks—they want buckets. Put related risks under the right framework categories so cyber, facilities, and workforce roll up cleanly. One mega-record or orphaning frameworks just hides the structure.
Full Explanation
A city manager who wants the board pack to show cyber, facilities, and workforce risks grouped under the enterprise risk framework—not a flat dump of 200 rows—needs related risks categorized under appropriate risk framework categories so rollups and board reports can aggregate by theme. Framework categorization makes civic board reporting actionable. Removing framework associations so each risk stands alone fails by concept because uncategorized flats cannot roll up by theme. Storing board narratives only in slide decks and detaching risks from frameworks fails by concept because slides without structured categories drift from the register. Merging all risk instances into one mega-record labeled Enterprise fails by concept because a single blob destroys entity-level ownership and scoring. Exam caveat: CIS-RC uses risk framework categories to aggregate board-ready thematic views. Operational check: ensure cyber, facilities, and workforce risks carry correct framework categories, generate a board report rolled up by category, and confirm the pack shows grouped themes rather than 200 ungrouped rows. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.