Which of the following relationship sets is a valid example of a many-to-many relationship in the data model?

• A. Entity Type and Entity Class
• B. Indicator Template and Entity Type
• C. Control and Risk
• D. Policy and Objective

Answer: (C)

A many-to-many relationship is one where records on both sides can relate to multiple records on the other side. In IRM, this is a natural fit for the link between controls and risks: a single control can address multiple risks, and a single risk can be mitigated by multiple controls. This reciprocal, multi-link connection is exactly what a join or cross-reference table is used for in data models, which is why Control and Risk exemplify a many-to-many relationship.

The other pairs typically model one-to-many or hierarchical connections. For example, a type and a class often reflect a classification structure where one class can encompass many types but not necessarily each type linking to many classes. An indicator template and an entity type usually tie to a specific entity type, not multiple types per template. Policies and objectives are commonly structured so a policy relates to multiple objectives, but an objective is generally defined within the context of a single policy in many models. This makes them less fitting as a many-to-many example.