What happens when you assign an Entity Type to a Risk Statement?

• A. An assessment will be automatically generated to test each Entity listed in the Entity Type
• B. A risk assessment is created automatically for every Entity listed in the Entity Type
• C. A risk is automatically generated for every Entity listed in the Entity Type
• D. The Entity is now going to present a risk score and controls are going to be tied to it

Answer: (C)

When you assign an Entity Type to a Risk Statement, the system creates a separate risk record for every entity that belongs to that type. This lets you manage and score risk on an entity-by-entity basis. It isn’t automatically generating assessments or tying in controls at this step, and it doesn’t imply the entity will automatically show a risk score or have controls applied right away. For example, if the Entity Type includes three applications, you’ll end up with three individual risk records, one for each application, ready for evaluation and remediation planning.