We are in the design of IRM. I know that issues can be generated automatically when a control or a risk indicator fails. I am hesitant to turn the automation on because a lot of issues are going to be reported manually and I am concerned with duplica...
Hi All, I need help to get the implementation documents or the documents on GRC and Security Operations. Thanks
Hi All,I would like to know how to set-up confidentiality for GRC tables other than OOB tables?There are a few tables for which this feature is supported by servicenowWould like to know if there's any other way I can configure the same for other exis...
Hi All,I have a query on the document templates. There is an existing template on the sn_doc_template table. The requirement is to modify the logo image, and in order to do that added an attachment to the template. But user added 2 more images and tr...
I have set the "Read-only" flag on a number of assessment metrics but it has no effect when the assessor is completing the assessment - they can still change the answer.Is it meant to set the answer as read-only to the assessor or am I misunderstandi...
Hi every one,Given the number of entities, how are using the Risk appetite and tolerance? are you defining them at the risk statement and autopopulated at the risk record? What is the goal of the risk appetite at the enity level? Your input is very a...
How to add fields from various tables into an audit report template if the template is in HTML format? Thanks
Greetings, I have the following questions in regards to relating an Entity directly to a Control Objective Is it possible to bypass mapping a Control Objective to an Entity Type and instead map the Control Objective directly to an Entity?What would b...
Hi Friends,We are trying to set up the Advanced Risk Assessment where the customer wants to assess each control on 2 factors say Design and Operating Effectiveness.But current OOB ServiceNow solution only provide ability to assess entire control envi...
What is the purpose and advantage/disadvantage of using the 'Applies to record' option on the entity record?
Hi Team, We are trying to set up Advanced Risk Assessment where customer asked to display some additional fields on the Inherent Assessment section. Current OOB layout does not have any dedicated field for Impact and it has only the calculated impact...
In the ServiceNow Regulatory Change Management, What is the difference between the Regulatory Alert and Source Document Alert?Are they related? And should one workflow be performed before another?
Hi Everyone, I have a requirement where I need to show the field message based on field value changes but the message contain a link which not possible in field message but client wants below that field only is there any alternate way to achieve the ...
I have created a scripted indicator to look at Test Results relating to a specific server class. The supporting data field should show all in scope Test Results but for some reason the option to look through all of the results is grayed out and only ...
Is anyone using GRC Audit Management to conduct SOX audits? If so, how are you flagging control test failures that are significant deficiencies or weaknesses? I'm seeing issues and observations but not seeing a way to flag either as a deficiency or...
