Department directors should see only risks tied to their entities. Which configuration approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Directors need their street, not the whole city map. Scope register views to their entities so they see owned risks without swimming in everyone else’s.
Full Explanation
Department directors should see risks tied to their entities through register views or filters scoped by those entities so visibility matches ownership boundaries. Scoped visibility supports accountability without drowning directors in the full municipal register or over-privileging them. Architecture here is least-privilege presentation of the shared risk model.
Giving every director the GRC admin role so nothing is hidden grants configuration power far beyond view needs and endangers methodology integrity. Exporting the full enterprise register to a shared drive weekly bypasses ACLs and creates stale shadow copies. Hiding the risk application from directors and briefing them verbally only removes self-service ownership visibility.
Exam caveat: view scoping ≠ admin role. CIS-RC access design favors entity-scoped visibility for owners and directors.
Operational check: configure director views filtered to their entities; log in as a director test user; confirm out-of-scope risks are not editable or listed per policy; ensure no director receives sn_grc.admin for convenience.
Entity-scoped views should align to director responsibility matrices already used for budget and service ownership, reducing arguments about who sees which risks. Provide a governed enterprise rollup role for the CRO or CIO, separate from director views, so citywide visibility exists without granting every director GRC admin. Never satisfy curiosity by weekly full-register exports to shared drives; those exports become stale shadow systems of record.