In current IRM setup, Entity owner is global across the board which we can understand from reporting perspective. However, Control objective owners are tied to the entity owners by default which is not common across industry.
To explain more see below image in our use case:
We have common entity Business Application class which is owned by the BA Owner and Database owned by the DB Service Owner. However there are various Control frameworks like Sox, Secure Dev, NIST etc. and each of these frameworks, we have many control objectives tied to the same entities as above.
The problem is there is no way to add the Control Owners dynamically based on the entity mapping dynamically. E.g. For Sox related controls, the Control owner must be selected from a Business Application record and it links to the Support Manager of the BA where as for the NIST related controls for the same Business App, it links to the Development manager in the control owner.
Currently there is no way we can define the Control owners based on the entity or entities mapped to a specific field on the mapping. How do we achieve as we are talking of thousands of Controls / Entities?
