A transit authority’s appetite breaches currently live only in a shared spreadsheet footnote. Which architecture should replace that pattern?
Select an answer to reveal the explanation.
Short Explanation
A spreadsheet footnote is a sticky note on a moving train—easy to miss. Put appetite breaches into IRM workflow with an owner, a due date, and a trail so leadership actually sees the breach.
Full Explanation
Risk appetite and tolerance only govern behavior when breaches create accountable work. For a transit authority, architecture should replace spreadsheet footnotes with visible IRM workflow that assigns owners, due dates, and an audit trail when appetite or tolerance is exceeded. Leadership then sees breaches as managed exceptions inside the system of record rather than as buried comments that never become tasks. Civic GRC maturity depends on that systematization.
Keeping breaches offline and emailing a weekly PDF to the CIO fails because offline notes lack durable workflow, assignment, and searchable history tied to the risk. Raising appetite only after an audit finding is published inverts control: appetite should constrain operations continuously, not wait for third-line discovery. Storing breach notes on a personal desktop falsely equates private files with clear ownership and destroys enterprise visibility and continuity.
Exam caveat: appetite without breach workflow is documentation theater. CIS-RC expects breaches to drive IRM tasks and trails, not informal side channels.
Operational check: define tolerance thresholds on priority transit risks; trigger a test breach in a non-production or controlled path; confirm a workflow item opens with owner and due date; verify the CIO or designated approver can see the trail in IRM without opening a personal spreadsheet.