Arun - This is a really broad question with lots of possibilities and important considerations as it forms the foundation of IRM. I would highly recommend connecting with a partner implementer or internal risk teams to help define what your entities, entity types, and their relationships to each other should look like. You should consider how you want your risks and controls to be deployed to the organization and what reporting you require to get lead your design of the entity hierarchy.
You will not get detailed answers from a community forum, just very generic information and decisions as we will not know your organization and use cases.
