Which of the following records is not associated with a lifecycle focus in GRC models?

• A. Policy
• B. Policy Exception
• C. Control
• D. Control Objective

Answer: (D)

In governance, risk, and compliance models, items that move through a formal lifecycle are those that are created, reviewed, approved, implemented, monitored, and eventually retired. Policies are developed, reviewed, published, and updated as needed; policy exceptions are requested, approved, tracked, and closed; and controls themselves are designed, implemented, tested, operated, and retired as part of managing risk and ensuring compliance.

A control objective, however, is a statement of what a control is intended to achieve—the purpose or goal behind the control. It’s more about the intended outcome and design consideration than a concrete artifact that progresses through approval, deployment, and retirement. Because it represents intent rather than a record that undergoes lifecycle stages, it isn’t tied to the lifecycle focus in the same way as policies, policy exceptions, or controls. Therefore, it is the item that is not associated with the lifecycle focus in GRC models.