How to perform Control Testing in IRM/GRC

[alvira]

Hi
I'm practising IRM/GRC in my PDI and have completed Control Lifecycle and Indicators. Now I want to learn how to perform Control Testing. I can see control testing options in both Risk Workspace and Compliance Workspace, so I'd also like to understand which approach is recommended and why.

Could someone please share the steps to create and execute a control test?

[Dr Atul - LNG]

Hi @alvira 

This is a really common question when you’re first getting into IRM, so you’re definitely not alone 🙂

There isn’t a separate control testing process for Compliance versus Audit. Control Testing is shared across IRM, and ServiceNow just exposes it in different workspaces based on who’s using it.

You’re seeing Control Testing in the Compliance Workspace because that’s where day-to-day, ongoing compliance work happens. Compliance teams run control tests there to make sure controls are operating as expected against regulations and internal policies.

You’ll also see control tests mentioned in Audit Workspace training because auditors rely on those same control tests and results as evidence during an audit. In many cases, audits reuse existing control testing rather than starting from scratch.

So in simple terms:

• Compliance Workspace is where control tests are usually created and executed

• Audit Workspace is where auditors review and leverage those results

As for training, there isn’t a standalone “Control Testing” course. It’s covered within the broader IRM / GRC courses in Now Learning, especially around Policy & Compliance and IRM fundamentals.

Once you start using it, the overlap will make more sense — it’s one control testing framework, just used by different teams for different purposes.

CC: 

@Matthew_13 

[Dr Atul - LNG]

Which Approach is Recommended and Why?

The Compliance Workspace (or Audit Workspace) is the recommended route for standard control testing. [1]

• Why Compliance/Audit? Control tests evaluate whether a control is operating effectively over a specific period of time to satisfy a policy, regulation, or citation. The Compliance Workspace tracks day-to-day control operation, while the Audit Workspace allows internal or external auditors to execute formal test plans against those controls to gather evidence. [1, 2, 3]

• When to use the Risk Workspace: The Risk Workspace is primarily optimized for Advanced Risk Assessments (ARAs), risk appetite tracking, and Key Risk Indicators (KRIs). While you can see test plans in the Risk Workspace to understand mitigating controls, formal field testing and formal audit tasks belong natively in the Compliance/Audit structures. [1, 2, 3, 4, 5]