In this risk-management model, what must be true for a control objective and a risk statement to be automatically linked?

In this risk-management model, what must be true for a control objective and a risk statement to be automatically linked?

• A. The statements must share the same Entity Type
• B. They must share the same Entity Type
• C. The risk owner must approve a link
• D. The control has a frequency set

Answer: (B)

Automatic linking between a control objective and a risk statement hinges on the artifacts belonging to the same category, or Entity Type. When both items are defined within the same Entity Type, the system recognizes them as part of the same domain and can map the control objective to the corresponding risk statement without requiring manual steps. If they don’t share the same Entity Type, the relationship isn’t established automatically, and you’d need to link them manually or via a different rule. The risk owner approving a link would introduce a manual step, not an automatic one, and a control’s frequency relates to how often the control is evaluated, not to whether linking can occur.

Automatic linking between a control objective and a risk statement hinges on the artifacts belonging to the same category, or Entity Type. When both items are defined within the same Entity Type, the system recognizes them as part of the same domain and can map the control objective to the corresponding risk statement without requiring manual steps. If they don’t share the same Entity Type, the relationship isn’t established automatically, and you’d need to link them manually or via a different rule. The risk owner approving a link would introduce a manual step, not an automatic one, and a control’s frequency relates to how often the control is evaluated, not to whether linking can occur.