A use case's risk tier in the governance inventory needs to be set. Which factors should determine it?
Select an answer to reveal the explanation.
Short Explanation
You don't set risk by ownership or code language. You set it by asking what happens if the use case is wrong, who it touches, and how much a human is in the loop.
Full Explanation
The correct approach is to classify by impact, regulatory exposure, data sensitivity, automation level, and the population affected. Together, these factors describe how much harm a use case could cause and to whom, which is what a risk tier is meant to capture. Classifying by which team happens to own the use case is incorrect because team ownership is an organisational detail with no bearing on actual risk. Classifying by how recently the underlying model was trained is incorrect because training recency says nothing about the consequences of the use case's decisions. Classifying by the programming language the application was written in is incorrect because implementation language is a technical detail unrelated to impact or sensitivity. For the exam, remember the five classification dimensions together, not any single one in isolation.