Which of the following statements best describes the Document extension set?

• A. Risk, Control
• B. Control Objective, Citation
• C. Risk Framework, Policy, Authority, Document
• D. Risk Statement, Control Objective, Citation

Answer: (C)

In ServiceNow IRM, the Document extension set defines the types and metadata that describe governance documents and how they relate to risk work. It encompasses four elements: Risk Framework, Policy, Authority, and Document.

• Risk Framework provides the structure and methodology used to categorize and manage risk.

• Policy codifies the rules and guidelines that govern activities and controls.

• Authority identifies who has the ownership or approval responsibility for the documents.

• Document is the actual artifact that captures the information and links to its framework, policy, and authority.

This combination is why the option including Risk Framework, Policy, Authority, and Document is the best description: it covers the main kinds of items that live in the Document extension set and the governance context around them. Other options mix in items that belong to different aspects of risk work (like controls, objectives, or citations) and don’t capture the full scope of what the Document extension set describes.