Which option is a typical example of a record type that can be extended by risk-related tables in the GRC model?

Which option is a typical example of a record type that can be extended by risk-related tables in the GRC model?

• A. Risk
• B. Citation
• C. Policy
• D. Control

Answer: (A)

In the GRC model, the risk record serves as the central base that gets extended by various risk-related tables. This design lets you enrich a single risk with domain-specific data—such as assessments, treatments, or impact details—without creating separate root structures for every type of risk. While policies, controls, and citations are important and are linked to risks, they are standalone record types rather than bases that are extended to add risk-focused information. So the typical example of a record type that can be extended by risk-related tables is the risk record, because it yields a flexible, scalable way to capture diverse risk data through extensions.

In the GRC model, the risk record serves as the central base that gets extended by various risk-related tables. This design lets you enrich a single risk with domain-specific data—such as assessments, treatments, or impact details—without creating separate root structures for every type of risk. While policies, controls, and citations are important and are linked to risks, they are standalone record types rather than bases that are extended to add risk-focused information. So the typical example of a record type that can be extended by risk-related tables is the risk record, because it yields a flexible, scalable way to capture diverse risk data through extensions.