Which of the following best describes the function of an Entity Type in relation to a Risk Statement?

• A. It generates a test assessment only
• B. It creates a risk assessment only
• C. It automatically generates a risk for every Entity listed in the Entity Type
• D. It generates a list of controls only

Answer: (C)

Entity Types define which entities a Risk Statement will apply to. When a Risk Statement is tied to an Entity Type with auto-generation enabled, the system creates a separate risk record for every Entity listed in that type. This is what makes the process scalable: you get a distinct risk for each entity (for example, each business unit, asset, or location) using the same statement without entering them one by one. This approach ensures consistent risk context and coverage across all entities in the type.

In contrast, generating a test assessment, creating a risk assessment, or producing a list of controls are separate activities or outputs that don’t describe the core function of the Entity Type with respect to a Risk Statement.