Hi everyone,We are using a ServiceNow group/learning instance to simulate a real-world GRC environment (different roles like admin, risk analyst, auditor, approver, etc.). MFA is enforced, and we understand it cannot be disabled.Issue: We want to avo...
I want control owners (entity owners) to have visibility to controls they are owner of. I have granted they sn_grc_business_user_lite role. But now they have visibility to all the controls in the system. What is the best approach to limit their visib...
Hi, We are trying to use SAE for control attestation but When we launch control attestations, the Smart Assessment Engine generates one assessment task per control. In our scenario, a single control owner has 20 applications (entities), and each app...
Can someone tell me IRM ootb KRI Dashboards names. Which includes KRI details
Hi All,How can i implement Risk mitigation strategies and Risk metrices ? How can monitor the risk metrics?What steps need to follow ? How can we propose Risk mitigation approach ?Any suggestion will be highly appreciate .
Hi All,what all information need to know in deeply for risk frameworks (ISO 31000, NIST, COSO) and compliance standards (SOX, GDPR, PCI-DSS, HIPAA) for GRC Project ?Please assist.
Hi All,Can anyone help me for Audit Management business use cases ? How to identify trends, issues from the data and opportunities for improvement. for those ?Please assist.
Our controls are derived from our policies and standards, I'd like to be able to build these with Hyperlinks to the related 'Policy' associated KB article. The logic here is for the control data to be pulled into a smart assessment during the attesta...
Hi ServiceNow Experts,Need your valuable inputs on the below requirement and its feasibility in ServiceNow:Requirement -Client wants to design questionnaires which can vary from one audience to another and doesn't follow any Standard Template. The Qu...
I created a Control Attestation Template using Smart Assessments. Initially, I was able to create attestations without any issues. However, after accidentally physically deleting the Control Attestation Template, attestations with the newly created C...
I have created an approver group for GRC Digital Resilience Incident Reporting (DRIR) application with roles of "sn_dri_inc_rptg.digital_resilience_incident_user" and "sn_oper_res.user". The approvers need to have Read only access to the DRIR case,...
Hello Team,We would like to understand how collaboration is expected to be achieved in Classic Control Attestations within ServiceNow GRC/IRM. Specifically, we would like your guidance on:* Whether Classic Attestations natively support collaborative ...
Hi everyone,I’m facing an issue with the Risk Assessment Scheduler and would appreciate some guidance.I need to move an entity from one Risk Assessment Scheduler to another. Currently, an entity can only be associated with one scheduler at a time, so...
As part of our Third-Party Risk assessments we do a full SOC2 Type2 Report review. As part of that review we are required (by our upper management) to obtain attestations from vendor contract owners that any Complementary User Entity Controls (CUECs)...
Is it possible to modiffy the inherent and residual assessment scoring criteria after the RAM is published? I am not making changes to the factors, just want to change the qualitative scoring criteria.
