Looking for process suggestions or ideas

[Meerk]

Hi All,

Relatively new to ServiceNow development and the developer role in general. We have a business process that utilizes a flow with over 150 steps. The flow has some inconsistent actions that are making it tricky for our teams when it comes time for auditing, and I wanted to see if anyone had suggestions for business process to replace our bulky flow. Business Process outlined below:

We have a waiver that departments can submit to give temporary acceptance for security risks that need to be mitigated. For example, say there is a vendor product being used that has a vulnerability that needs to be patched, but the vendor has not released a patch yet. Our teams can use the waiver to request from our security team to "accept" the vulnerability for a reasonable amount of time. Otherwise, it is security's role to audit and enforce risk mitigation.

The waiver is just a form that was built in ServiceNow, but there is an approval section for our Information Security Office (this is just a dropdown tab that they swap from either pending to approved/rejected). The submitter will fill out the relevant fields (servers/departments affected, duration of the waiver being requested, business justification for request, etc.).

Currently, the flow kicks off when the record is created and assigns to our ISO. Then, there are if-statements depending on the approval (if rejected, send notification and flow ends, if approved, send notification and then continue to the timers).

The timers are where the flow is bulky: there is an "if" statement for each available duration (if 1 week, then; if 2 weeks, then; if 1 month, then). They work by creating a flow variable, "do the following until" step with a 1 day wait timer, then adding 1 to the variable until the variable is equal to the number of days of the waiver duration (7 for 1 week, 21 for 3 weeks, 30 days for 1 month).

After the timer has ran for the duration, it will update the state of the wavier from "Active" to "Expired" and then notify the submitter.

Basically, I am wondering if anyone has a similar business process to what I've described and if there are potentially better solutions worth looking at in ServiceNow (preferably OOB). Right now, I am looking at rebuilding the parent flow to use some subflows. The subflows would be the wait durations, so I'd create a subflow for each duration and then have the parent flow call the subflow. It should at the very least cut down on some steps to make editing the flow easier in the future.

The flow as it currently is works MOST of the time. On occassion, the timer does not appear to kick off, and for 1 out of every 4 or 5, the approval/expire notification goes out every time a work note is added.

As a side note: our organization is very security focused, so these get used more often then I would expect in other organizations.

Thanks for taking the time to read this, and if you do have any suggestions whether it is business process or flow/subflow creation related, I appreciate the feedback! I can add additional information if needed, but felt the post was already text-heavy.