Mapping a Control Objective directly to an Entity (GRC)

[Navraj]

Greetings, I have the following questions in regards to relating an Entity directly to a Control Objective

• Is it possible to bypass mapping a Control Objective to an Entity Type and instead map the Control Objective directly to an Entity?
• What would be the steps to perform this?
• Would the controls within that CO automatically generate within the linked Entity?
• What would be the pros and cons of doing this? 

[telmo_nabais]

Hello Navraj,

just challenging your question, isn't creating a control for an entity based on a control objective (OOTB functionality) the same as what you intend with "Map a control objective directly to an entity"?

Kind regards!

[AndersBGS]

Hi @Navraj ,

Please see the architecture schema below utilized for GRC, Control Objectives, Entities and entity types:

The reason why a control objective should be mapped to an entity type is, that a control will be created for each entity when entity type and control objective is mapped together. 

If my answer has helped with your question, please mark my answer as accepted solution and give a thumb up.

best regards

Anders

[Ahmed Drar]

Hi Navraj,

The short response is this is not a good idea and I don't know what this will add to the table . You could use a link between control and entity to get the optimal OOTB logic.

I hope this helps.

Ahmed

Please mark my answer as Correct / Helpful based on the Impact

Community Rising Star 2023

[telmo_nabais]

Hello Navraj,

not sure exactly in which version this was introduced but just realised that from a control objective/risk statement there is a related list "Additional entities" which meets your requirement.

• It allows you to bypass mapping a Control Objective to an Entity Type and select directly what are the Entities where the control is implemented and monitored
• Just use the mentioned related list to achieve what you want
• Controls and risks are automatically generated for the control objective/risk statement within the linked entity
• I didn't use this functionality yet on a real context but can assume you gain flexibility on scope definition, you lose a central point of scoping for automation of risk/control generation if you don't use entity types