Entity Scoping
About 25% of the CIS-RC exam — see all 7 domains.
Entity scoping is the practice of defining what in the organization is subject to risk, control, and compliance activity, and how broadly GRC content applies. It is the backbone shared by every IRM application.
Entities and the common core. The GRC/IRM common framework supplies a shared data model used by Policy & Compliance, Risk, and Audit. The central record is the entity: a GRC representation of something you want to govern (a business unit, application, vendor, facility, process, etc.). Entities connect organizational objects (often CMDB CIs, departments, or other table records) into the GRC world so that controls, risks, and audits can attach to them. Before the New York release this record was called a profile; profile type, profile class, and policy statement are the old names for entity type, entity class, and control objective.
Entity. An entity is the GRC record that content is applied to or scoped against. It usually refers to a source record that represents a real-world item (a server CI, a department, a vendor record), and it can also be created manually as an independent entity. Entities are the instances.
Entity type. An entity type defines a class of entities by pointing to a specific table and (optionally) a condition/filter. It tells GRC "entities of this type live in this table and match these criteria." Its entity filters generate entities in bulk from records in any table, and the control objectives and risk statements associated with the entity type generate controls and risks for those entities. Example: an entity type "Critical Applications" sourced from cmdb_ci_appl with a condition business_criticality = 1.
Entity class. An entity class is a tag that classifies entities (e.g., Department, Business Application, Business Service) for grouping, aggregation, and reporting. Entity class rules assign a class automatically by source table, and entity tiers apply a level to classes (for example, tier 1 for the most critical). An entity class does not choose source records; the entity type's entity filters do.
Entity relationships. Upstream and downstream relationships between entities show how controls and risks affect each other and support roll-up reporting. Inheriting a parent's control results is done with common controls and reliant entities.
Scoping = applying GRC content to the right entities. When you associate control objectives (or policies) and risk statements (or risk frameworks) with an entity type, a control or risk is generated for each entity in it; that is scoping. Scoping can be done:
- Manually (create an independent entity or add content to one entity), or
- Dynamically via entity-type conditions so newly matching records automatically come into scope.
Implementation flow (typical): create entity classes (and class rules) and entity types → add entity filters on source tables with conditions → generate entities → relate entities (upstream/downstream) → associate control objectives and risk statements with entity types to generate controls and risks.
Key gotchas for the exam:
- Distinguish entity (instance) vs entity type (definition/table+filter) vs entity class (tag for grouping and reporting).
- Entities are the join point between org objects and GRC content; they are what controls and risks (and, through them, indicators) ultimately attach to.
- Dynamic scoping via entity-type conditions keeps scope current as data changes.
Sample questions from this domain
Three of the 75 in this domain, with the reasoning. The full set is in the question bank.
An entity type named Applications has an entity filter on a business application table. In the GRC framework, what is each entity that the filter generates?
- A. A grouping record that collects the applications matching the filter condition, such as the critical business applications
- B. A record representing something that can be scoped for compliance/risk, such as a business unit, application, or process ✓
- C. A control record generated for each matching application, such as an access review, from the objectives on the entity type
- D. A classification tag placed on each matching application, such as Application or Department, by a class rule
Why: Each source record that matches the entity filter becomes an entity: a record representing something that can be scoped for compliance and risk, such as a business unit, application, facility, or process, which controls and risks are then associated with. The grouping that collects all matching records is the entity type itself (Applications), not each entity. Controls such as an access review are generated for the entity from the control objectives associated with the entity type; they are not the entity. A classification such as Application or Department is an entity class, a tag assigned by an entity class rule or the entity filter, not the entity record.
Starting with the New York release, the GRC record formerly called a profile was renamed. What is its current name and purpose?
- A. Entity: a record that represents a business item in GRC so controls, risks, and other items can be associated with it ✓
- B. Entity type: a grouping of records that match filter conditions so that controls and risks are generated for each of them
- C. Entity class: a tag that classifies records in GRC so they can be grouped, filtered, and reported on
- D. Auditable unit: a record that represents an area of the business in GRC so that audit engagements can be scoped against it
Why: Starting with the New York release, the term profile was replaced with entity. An entity represents a person, process, department, application, or object in GRC so controls, risks, indicators, and assessments can be associated with it. Entity type is the new name for profile type (the grouping of records that match filter conditions), and entity class is the new name for profile class (the classification tag), so neither is the renamed profile. An auditable unit is an Audit Management record used to scope audits; it was never called a profile.
What is the role of an entity type in the GRC framework?
- A. It tags entities with a classification such as Department or Business Application so dashboards and reports can group them, and entity class rules can assign it per source table
- B. It groups entities that match filter conditions on a source table, and the control objectives and risk statements associated with it drive which controls and risks are generated ✓
- C. It ranks entity classes into levels such as Tier 1 and Tier 2 so the most critical entities can be filtered, and lower tier risk scores can roll up into the higher tier entities
- D. It defines the upstream and downstream relationships between entities so the controls and risks on child entities roll up to their parent entities in hierarchy views and reports
Why: An entity type (formerly profile type) groups entities that match its entity filter conditions, for example Applications or Departments, and associating control objectives and risk statements with it generates controls and risks for its entities. Tagging entities with a classification for reporting, set automatically by entity class rules, describes an entity class. Ranking entity classes into tiers so critical items can be filtered and lower tiers roll up describes entity tiers. Upstream and downstream links between entities are entity relationships (the entity hierarchy), not an entity type.