A transit GRC lead wants risk owners to update scores and responses while auditors and many managers may only view the register. What should be tuned?
Select an answer to reveal the explanation.
Short Explanation
Not everybody in the station should twist the risk dials. Tune roles so owners can score and respond while viewers stay read-only. Wide-open edit or SIR-only editors break the operating model.
Full Explanation
IRM role design separates who may update risk scores and responses from who may only view the register. Least-privilege edit for risk owners and GRC roles protects integrity while enabling collaboration. Broad edit for all users or unrelated SIR roles weakens control over the risk data.