Which of the following records is most likely to be an Entity in the GRC data model?

• A. Entity
• B. Indicator
• C. Policy
• D. Control

Answer: (A)

In ServiceNow IRM, the data model distinguishes between what you govern and the tools you use to govern it. An Entity is the subject of governance—the scope for risk assessment and control activity. It can represent a business unit, system, process, location, or other organizational element that you want to govern and measure. Policies define the required behaviors, controls are the mitigations you implement, and indicators are the metrics you use to monitor risk and control effectiveness. Since the question is asking which record represents the thing being governed, the Entity fits that role best, as it is the object around which governance, risk, and compliance activities revolve. The other records describe the governance artifacts themselves, not the subject of governance.