Security findings from recent assessments need council-level visibility. Which body typically provides oversight of such findings in the municipal assurance ecosystem?
Select an answer to reveal the explanation.
Short Explanation
Big findings need a grown-up table—the audit committee—not just a help-desk ticket abyss. Self-assessments feed the story; the committee watches whether leadership owns the fixes.
Full Explanation
In the municipal assurance ecosystem, security findings that need council-level visibility typically flow to the audit committee or an equivalent oversight body. That body oversees whether management addresses significant risks and control weaknesses. Management self-assessments feed the assurance picture by surfacing operational status, but they do not replace governing-body oversight of material findings.
Assigning oversight only to the facilities landscaping crew because physical security is the 'sole concern' ignores enterprise cyber and governance risks and misplaces accountability. Contracting social media influencers to rate findings for entertainment is not an assurance mechanism. Leaving findings solely with the help desk without a governing-body reporting path buries systemic issues in ticket queues and denies leadership the visibility needed for funding and risk decisions.
Exam caveat: SY0-701 governance questions expect audit committee (or equivalent) oversight of findings, with management self-assessments as inputs—not operational teams alone and not publicity gimmicks.
Operational check: define severity thresholds that escalate assessment results to the audit committee, present aging open findings with owners and due dates, and require management responses. Align self-assessment cycles so committee packets include both independent assessment results and management’s view of residual risk.