Which of the following records does not have a lifecycle?

• A. Control Objective
• B. Policy
• C. Policy Exception
• D. Control

Answer: (A)

In IRM, records that drive governance and operations—policies, policy exceptions, and controls—move through defined lifecycle stages such as drafting, approval, publication, review, and retirement. A control objective, however, is a descriptive statement of what a control is intended to achieve. It serves as a guiding goal rather than an operational artifact that goes through change, approval, and retirement processes. Because it doesn’t itself undergo those lifecycle steps, it does not have a lifecycle. For example, you might state a control objective like “Ensure data confidentiality,” which informs the design of controls but isn’t implemented or retired as a separate lifecycle artifact.