Five ways the new Smart Assessment Engine can dramatically improve your GRC assessments

[Mary Hain]

The ServiceNow Smart Assessment Engine (SAE) application can help your organization reduce the manual burden and costs of your compliance and control effectiveness assessments through automation. SAE offers exceptional flexibility and robust capabilities to perform a variety of assessments and keep you up to date on changes to your risk posture.

What is SAE?

SAE is a new feature of Integrated Risk Management (to start). Risk and compliance teams can use SAE to create and distribute compliance and control effectiveness assessments as they evaluate risk mitigation in an enterprise.

One of its biggest benefits is that it puts assessment design, distribution, analysis, and reporting in the hands of the risk and compliance practitioners, eliminating the need to involve a developer or partner to develop or modify assessments. This improves your productivity, increases time to value, and reduces costs.

Where is it available?

SAE is currently available for ServiceNow Control Attestation and Risk Identification within the Integrated Risk Management entitlements. A Cyber Risk Institute (CRI) assessment is also available as part of our CRI support. It is now a common core capability for other risk products, including Third-Party Risk Management in the Zurich release.

How does SAE make assessments easier?

Simply, it makes the job of risk and compliance teams much easier by improving how compliance assessments are performed in five simple ways. Assessors can now:

1. View an overview of compliance and control effectiveness assessment template-related information and review the published and unpublished assessment templates in one place.
2. Access a template designer to create and customize compliance and control effectiveness assessment templates in Control Attestation and Risk Identification. Assessors can easily add instructions, questions, and references. They can define assessment parameters such as the question types, justifications, and conditional visibility without involving external resources.
3. Manage the entire assessment process in a single workspace, including triggering assessments using Workflow Studio or a script and specifying assessment templates and respondents. They can collect the responses, reassign in-progress assessments, or cancel assessments from within the workspace.
4. Combine multiple assigned compliance and control effectiveness assessments into a single view where they can manage, submit, or reassign them in bulk. This streamlines response time and makes assessment handling much faster.
5. Migrate existing assessment designs and metric types to the SAE assessment templates so that they can take advantage of SAE automation, analysis, and reporting for existing assessment designs.

What are the benefits for my organization?

The new smart features dramatically streamline the assessment development and response within your organization. It offers an intuitive user experience, is highly configurable, and provides access control. SAE removes many of the hurdles to developing assessments that are timely, consistent, and include references that enable the assessor to answer the questions more accurately. ​

Over time, SAE will deliver a cohesive, end-to-end assessment experience as a common core feature across the entire risk product portfolio. It will help ensure information is accurate, easier to analyze, and drives better decisions on your risk program. Assessments that used to take weeks to develop can now be created in hours or days.

How do I activate it?

You can activate or upgrade SAE by downloading it from the ServiceNow Store and then configuring the settings in the initial setup checklist. This is available for Compliance and Control Effectiveness Assessments starting in the Xanadu release.

For more information, visit Product Documentation.

[Matthew Maes]

Thanks for the great article!
When I went to set up SAE, I noticed there seems to be some critical information missing in the docs to get fully up and running. For example, the docs do not mention enabling the property sn_compliance.enable_smart_assessments

I put together YouTube video on all the steps to get up and running with SAE.

https://www.youtube.com/watch?v=s6R5BiRu6JI

[Mary Hain]

Thanks, Matthew.  I will share this with the team.  And thanks for creating a new version!

[Edward Halliday]

Hi Mary, is there any word when this new Smart Assessment Functionality will be rolled out for other applications such at TPRM. 

[Anup9431]

Hi,

How to bulk combine risk assessments using SAE? I see we can combine attestations[for controls] in compliance workspace. Where can we combine risk assessments (Do we have any new workspace for risk?). Also if possible please add some screenshots. It will be of great help.