IRM Table: Audit Plan

[kathymorris]

Hi,

Hi All,

We have IRM Advanced. A business unit has requested to add two selection items to the "Type" field in the Audit Plan form. They want "Internal Control Testing Plan" and "Control Environment Assessment Plan." Technically we can add the fields. However, I am wondering if we are putting this data element in the incorrect place based on its function. According to what I have read, this type of Test Plan and Assessment plan belongs in either a) Audit Test Plan or b) Control Assessment  or  possibly the Test Template.  Please correct me if I am wrong. My thought is if they place these two selections in the Audit Plan form, then some of the workflow will not be leveraged correctly. Based on ServiceNow's documentation control objectives are associated to the Test Plan via the "Audit Test Plan" table, not the Audit Plan form. 

Please see attachments. This is where I derived this from. 

What are your thoughts? Am I overthinking this? Or is this requirement ok to just add the selection values to the Audit Plan table only.

Thanks,

Kathy

[Vinod54]

Hello @kathymorris ,

You thoughts are rational than overthinking. 

Purpose of Audit plan?

Audit plan are for auditors to better plan the engagement in terms of potential problems, scope, goal and cost. 

Why audit plan not best place to add test plan types?

Audit Plan Type drives how the engagement-level planning is categorized and reported, it does not directly link to testing in an compliance lifecycle.

Where does Internal Control Testing Plan" and "Control Environment Assessment Plan fit in ?

1. Internal Control Testing plan: In my view, can fit in Test plan(sn_audit_test_plan) to categorize the kind of test plan.
2. Control test record, test plan steps will be automatically added to Control test so you can consider control test to categorize the type of control test as well. 

How to decide?

Purpose is key: Consult with the business, explain purpose of audit plan, test plan, control test. Based on their current and future requirement decide where to place the new choices. 

Concern of existing workflow disrupting?

It should not affect because couple of choices are only going to be added to the existing field. Even though the field may be used in any script or flow. We are not deactivating the choice or renaming it, so should not affect.

But there may condition builder which could have set up to look for type is not one of. In such cases yes may cause effect such condition in OOTB scripts are unlikely to occur. So not to worry much. 

If this answered your question, please hit Helpful and Accept as Solution.

Thanks,

Vinod Kumar M

ServiceNow Community