City council asks for risk reporting they can act on. Why is a dump of 500 raw risk rows the wrong architecture?
Select an answer to reveal the explanation.
Short Explanation
Five hundred raw rows is a haystack, not a brief. Council needs rollups by entity class and framework theme so they can steer. Hiding residual forever or only showing closed audits is not better reporting—it is less.
Full Explanation
A dump of 500 raw risk rows is the wrong architecture for city council reporting because reporting needs rollups by entity class and framework category—aggregation—not an unfiltered register dump. Councils steer with themes and priorities for public services, not haystacks. Claiming councils should never see residual scores for transparency reasons fails by concept because hiding residual reduces accountability rather than improving governance. Allowing only inherent scores and hiding residual from elected officials fails by concept because residual is what remains after controls and informs decisions. Limiting risk reporting to closed audit engagements exclusively fails by concept because ongoing risk oversight is not solely an audit-closed view. Exam caveat: CIS-RC executive reporting emphasizes aggregation by entity class and framework category. Operational check: build a council-facing report with residual rollups by entity class and framework category, suppress the 500-row raw dump as the primary view, and validate leadership can identify top themes in one page. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.