Setting up entity classes is required when using which GRC feature?

Setting up entity classes is required when using which GRC feature?

• A. Adding to the policy exception integration registry
• B. Assessing the impact of a regulatory feed
• C. Setting up an object-based risk assessment
• D. Leveraging classic risk assessments

Answer: (C)

Object-based risk assessments require defining the types of objects you will evaluate. This is done by setting up entity classes, which describe the kinds of objects (and their relevant attributes) that risk will be measured against. The entity classes provide the schema and relationships that enable object-level scoring, impact analysis, and control mapping. Without these classes, there’s no framework to attach risks to concrete objects, so the object-based approach can’t function properly. Other GRC features—such as policy exception registry workflows or regulatory feed impact analyses—operate on different concepts and don’t depend on entity classes. Classic risk assessments also don’t use the object-focused model that requires entity classes. Hence, the need to set up entity classes points to object-based risk assessments.

Object-based risk assessments require defining the types of objects you will evaluate. This is done by setting up entity classes, which describe the kinds of objects (and their relevant attributes) that risk will be measured against. The entity classes provide the schema and relationships that enable object-level scoring, impact analysis, and control mapping. Without these classes, there’s no framework to attach risks to concrete objects, so the object-based approach can’t function properly.

Other GRC features—such as policy exception registry workflows or regulatory feed impact analyses—operate on different concepts and don’t depend on entity classes. Classic risk assessments also don’t use the object-focused model that requires entity classes. Hence, the need to set up entity classes points to object-based risk assessments.