A city manager wants the board pack to show cyber, facilities, and workforce risks grouped under the enterprise risk framework—not a flat dump of 200 rows. What IRM practice supports that?
Select an answer to reveal the explanation.
Short Explanation
Boards do not want a phone book of 200 risks—they want buckets. Put related risks under the right framework categories so cyber, facilities, and workforce roll up cleanly. One mega-record or orphaning frameworks just hides the structure.
Full Explanation
Risk frameworks organize statements and instances into categories that support aggregation and reporting. Categorizing related risks under framework themes enables board-ready rollups by domain. Detaching frameworks, collapsing everything into one record, or moving narrative only to slides undermines structured IRM reporting.