Owners must be notified when residual exceeds tolerance. Which configuration is needed?
Select an answer to reveal the explanation.
Short Explanation
If residual jumps the fence, somebody’s phone should buzz. Configure threshold notifications so tolerance breaches do not wait for a hallway chat or a marked-up printout.
Full Explanation
Owners must be notified when residual exceeds tolerance through configured notifications or workflow alerts tied to the tolerance threshold. Automated alerting makes appetite breaches operational for civic risk owners instead of relying on chance discovery. Configuration depth here is threshold plus notification path.
Relying on hallway conversations after committee meetings fails continuity and evidence. Printing the register monthly and highlighting breaches by hand reintroduces lag and manual error. Disabling tolerance fields so notifications are unnecessary deletes the governance control to avoid implementing it.
Exam caveat: tolerance without alerts is passive documentation. CIS-RC expects configured breach communication to owners.
Operational check: set tolerance; exceed it on a test risk; confirm the owner notification or workflow fires; retain tolerance fields and retire print-and-highlighter breach processes.
Notification content should include risk name, entity, residual versus tolerance, and a deep link into IRM so owners can act without searching. Escalate unanswered breach alerts to the risk owner’s manager on a defined SLA so civic tolerance breaches cannot languish unread. Disable print-and-highlight breach processes in the SOP once system alerts prove reliable for a release cycle.