A city’s risk framework must distinguish financial, operational, compliance, and technology risks for reporting. Which design choice best supports that?
Select an answer to reveal the explanation.
Short Explanation
Categories are filing drawers: finance, ops, compliance, tech. Label statements and risks so leadership can pull the right drawer instead of one giant unmarked pile.
Full Explanation
A city risk framework that must distinguish financial, operational, compliance, and technology risks needs an explicit categorization scheme assigned to statements or risks. Categories enable filtered reporting, committee routing, and appetite views by loss or risk type. Without labeled categories, leadership cannot pull coherent portfolios from a mixed municipal register.
Collapsing every risk into a single unmarked bucket simplifies data entry while destroying reporting utility. Using only NIST control families as risk categories confuses control taxonomy with risk-type classification; control families describe safeguards, not whether the exposure is financial, operational, compliance, or technology in nature. Categorizing solely by the department that last edited the record is an audit-metadata accident, not a risk taxonomy.
Exam caveat: risk categories and control frameworks are related but not interchangeable. CIS-RC framework design questions expect risk-type schemes on statements/risks for portfolio reporting.
Operational check: define the category choice list; require category on new statements; sample board reports filtered by financial versus technology; confirm last-editor department is not used as the category field.