A failed control test and an open risk response both point at the same access-review gap for a clinic. What architectural construct connects them?
Select an answer to reveal the explanation.
Short Explanation
When compliance and risk stub their toes on the same rock, use a shared issue—one problem record both sides can see. Parallel mystery tickets and “major incident closes everything” are how gaps get fixed twice or not at all.
Full Explanation
When a failed control test and an open risk response both point at the same access-review gap for a clinic, shared issues that can link risk responses and compliance failures to the same remediation problem connect them architecturally. One shared issue prevents duplicate civic remediation theater. Separate siloed tickets with no shared object fail by concept because teams cannot see overlap or coordinate fixes. A knowledge base synonym list with no workflow fails by concept because synonyms do not assign, age, or close remediation. An ITSM major incident that automatically closes all GRC records fails by concept because a major incident process should not blindly wipe compliance and risk work. Exam caveat: CIS-RC uses shared issues to unite compliance failures and risk responses on the same problem. Operational check: create or identify a shared issue for the clinic access-review gap, link both the failed control test issue and the risk response, assign one remediation owner, and verify both sides show the shared issue status. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.