Which of the following is a plausible trigger for automatic creation of an issue in GRC workflows?

• A. Attestation result is Not Implemented
• B. Policy approved
• C. Control tested
• D. Audit log created

Answer: (A)

Automatic creation of an issue in GRC workflows is driven by signals that a control gap needs remediation. When an attestation result comes back as Not Implemented, it means the control isn’t in place or functioning, creating a concrete deficiency that the system can automatically convert into an remediation task. This ensures ownership and work are tracked to bring the control into operation.

Other events described don’t inherently signal a deficiency requiring an action item. Policy approved reflects governance progress, not a defect. Control tested shows verification activity and evidence of performance, which only triggers an issue if the test reveals a problem or noncompliance. Audit log created is a record of activity, not a remediation request.