If a control objective has been related to a risk statement and scoped with the same entity type, what can we expect to occur?

If a control objective has been related to a risk statement and scoped with the same entity type, what can we expect to occur?

• A. The control objective will be marked as compliant
• B. A control for this objective, with a matching entity, will be related to the registered risk for this risk statement as a mitigating control
• C. Risks for this risk statement will be moved back into a Review state
• D. Risk scores will automatically decrease for the risk statement's risks since there are now mitigating controls

Answer: (B)

In ServiceNow IRM, linking a control objective to a risk statement and ensuring both are scoped to the same entity type creates a concrete mitigating control for that risk. When this relationship exists, a control for that objective is established with a matching entity and is related to the registered risk for that risk statement as a mitigating control. This formalizes how the risk is addressed: the mitigating control is tied directly to the risk, enabling tracking of how the objective reduces exposure and ensuring the mitigation is part of the risk’s control set. This is why the expected outcome is that a control for the objective becomes a mitigating control of the risk. It’s about the explicit, aligned relationship between the risk and a corresponding control that mitigates it. The other outcomes aren’t guaranteed just from this relationship. Marking the control objective as compliant requires evidence and assessments, not merely the linkage. Moving risks back to a Review state isn’t a default consequence of linking, and risk scores don’t automatically drop simply because a mitigating control exists—the score is typically updated through evaluations and scoring rules, not automatic linkage alone.

In ServiceNow IRM, linking a control objective to a risk statement and ensuring both are scoped to the same entity type creates a concrete mitigating control for that risk. When this relationship exists, a control for that objective is established with a matching entity and is related to the registered risk for that risk statement as a mitigating control. This formalizes how the risk is addressed: the mitigating control is tied directly to the risk, enabling tracking of how the objective reduces exposure and ensuring the mitigation is part of the risk’s control set.

This is why the expected outcome is that a control for the objective becomes a mitigating control of the risk. It’s about the explicit, aligned relationship between the risk and a corresponding control that mitigates it.

The other outcomes aren’t guaranteed just from this relationship. Marking the control objective as compliant requires evidence and assessments, not merely the linkage. Moving risks back to a Review state isn’t a default consequence of linking, and risk scores don’t automatically drop simply because a mitigating control exists—the score is typically updated through evaluations and scoring rules, not automatic linkage alone.