The overall goal of Entity Classes is to:

• A. To enable reporting and to support advanced risk assessment
• B. Show relationships between Entities and policies and map them directly to Citations
• C. Associate Control Objectives and Risk Statements with Risks and Controls
• D. To provide specific information about an Entity, such as who owns the Entity

Answer: (A)

Entity Classes establish a consistent category for groups of entities so you can treat them in a uniform way. The main purpose is to enable effective reporting and to support more advanced risk assessment because with standardized attributes and structures, you can generate meaningful, scalable reports across many entities and apply risk analysis that considers entity-level factors. This makes it possible to compare, aggregate, and drill into risk data by entity class, track trends, and drive informed decisions.

The other options describe useful capabilities, but they aren’t the overarching aim of Entity Classes. Mapping relationships between entities and policies to citations is a specific linkage task rather than the primary reason for defining entity types. Linking control objectives and risk statements to risks and controls is about how risks and controls are organized, not about the purpose of grouping entities. Providing owner information is a useful attribute-level detail, but it doesn’t capture why you define entity types in the first place.