A utility wants annual reassessment plus extra reviews when major changes land. How should that be configured?
Select an answer to reveal the explanation.
Short Explanation
Annual is the oil-change schedule; major changes are the check-engine light. Configure both so reassessment happens on the calendar and when the plant or architecture actually changes.
Full Explanation
Utilities and other civic operators should configure annual reassessment frequency plus event-based triggers for major changes so assessments reopen when conditions shift. Calendar cadence handles routine refresh; change triggers handle architecture, vendor, or process shocks between anniversaries. Together they keep residual current without waiting for audit requests.
Assessing once at go-live and never scheduling again freezes posture at launch. Reassessing only when audit requests evidence packages makes the third line the clock for first-line risk hygiene. Allowing any user to permanently lock scores with no schedule defeats governed reassessment.
Exam caveat: frequency plus event triggers is the standard Advanced Risk pattern—neither audit-driven-only nor forever-locked scores.
Operational check: set annual frequency on critical utility risks; define major-change triggers (for example go-live, vendor swap); simulate a major change and confirm assessment reopens; remove permanent lock rights from general users.
Event-based triggers should include concrete municipal change types—major architecture go-lives, vendor swaps, regulatory effective dates, and significant control failures—so reassessment is not limited to the anniversary date. Locking scores without a schedule creates false stability; require GRC admin and risk-owner agreement before any temporary lock, and always keep the annual cadence. Audit requests may still pull evidence packages, but they must not be the only reassessment clock.