Which statement best describes the purpose of Entity Classes?

Which statement best describes the purpose of Entity Classes?

• A. To enable reporting and to support advanced risk assessment
• B. Show relationships between Entities and policies and map them directly to Citations
• C. Associate Control Objectives and Risk Statements with Risks and Controls
• D. To provide specific information about an Entity, such as who owns the Entity

Answer: (A)

Entity Classes organize entities into types so you can report on and assess risk across those types. By classifying entities, you standardize attributes and risk scoring, enabling meaningful dashboards and analyses that compare like items and roll up risk across a group. For example, having an Entity Class for vendors lets you apply consistent risk assessments, owners, thresholds, and reporting specific to that class, and then aggregate results across all vendors. The other options describe activities that aren’t about the purpose of classifying entities: linking entities to policies or citations, mapping risk statements to risks and controls, or providing owner details for a specific entity.

Entity Classes organize entities into types so you can report on and assess risk across those types. By classifying entities, you standardize attributes and risk scoring, enabling meaningful dashboards and analyses that compare like items and roll up risk across a group. For example, having an Entity Class for vendors lets you apply consistent risk assessments, owners, thresholds, and reporting specific to that class, and then aggregate results across all vendors. The other options describe activities that aren’t about the purpose of classifying entities: linking entities to policies or citations, mapping risk statements to risks and controls, or providing owner details for a specific entity.