GRC
Hi All, I'm new to learn IRM module in GRC. Any one have any course notes or learning path and any referral videos can you please share with me or suggest me. Thanks in advanced!
Forum Posts
How do you get the organization's ODP / ODV info in Control Objective / Requirement into CAM
I know this might sound like a dumb question, but...How do I get my organization's ODV into the Control requirement or Objective easily? The org has a spreadsheet with each control objective and what the ODV is for the ODP values in the control. Ther...
Continuous Authorization & Monitoring - Control Requirement
In CAM module, Authorization Package, I have created Hybrid Controls from Baseline Controls. And from Hybrid Control screen with 2 Control Requirements, when I select Take Attestation at Requirement level checkbox and click Attest button, I am not ge...
Resolved! Vendor Management Workspace 21.1.5 – record-vertical not honoring Engagement related lists (Zurich)
After upgrading to Vendor Management Workspace v21.1.5 on Zurich Patch 6, we noticed a change in how related lists are rendered for Engagement (sn_vdr_risk_asmt_vendor_engagement) records. With the new record-vertical variant in UI Builder, our custo...
Resolved! workspace list Action "new" Button display twice for specific user
A specific user is experiencing an issue in the Risk Workspace. When the user opens a task from the Task List (nested task list) within the workspace, they see two "New" buttons displayed on the interface.This behavior appears to be user-specific, as...
Where can I find backend logics of "Add dependencies" and "Update dependencies" buttons used in BCM?
Hello Team, Where can I find the "Add dependencies" and "Update dependencies" buttons logic in the backend, which is available in the Business Impact Analysis, Planning and Events.Screenshot is attached for reference, please check. Thanks in advance!
Need Help with Report on Controls
Hi, I need help with a report. My requirement is when user select a risk statement, I need to show all the Controls associated with the Risk Statement.The relation between Risk statement to controls is as follows:Under Risk statement , there is M2M t...
Resolved! What is the 'Category' field used for in Citations?
Hi there, I’m trying to understand the intended purpose of the Category field on Citations in ServiceNow IRM, and whether it is expected to be actively used by business or Compliance users. When creating a new Citation, the Category field is visibl...
impact of Risk framework retires
I’m trying to understand the system and data impacts of retiring a Risk Framework. I know how it works for control but just want to double check on the risks.Specifically, I’d like clarity on the following:What happens to downstream records associat...
indicator tasks
want to confirm: OOB are indicator tasks created with control state = draft or control state=monitor? If draft is also creating indicator tasks, what is the logic behind this? Shouldn't only monitor state create indicator tasks?
List Field - Multi Select in Configurable Workspaces
Hello together, Does anyone know if there is a possibility to enable "multi select" for List fields in the Configurable Workspace like it works in UI16:Is there potentially an attribute or anything like that which could be enabled?
submitted advanced risk Assessment can not be approved
Dear IRM Experts, We are experiencing an issue with Advanced Risk Assessments in ServiceNow.Once an Advanced Risk Assessment is submitted, it moves to the state “Waiting for Approval.” However, it cannot be approved because no approval task is genera...
Policy exception goes straight to Analyze when raised form portal but not from workspace
can someone explain why a new policy exception goes straight to Analyze if raised from the service portal, but stays in New state when raised from compliance workspace? I've looked for business rules, workflows, that might doing this after the excep...
Adding Controls to Risk Assessment when Assesing Control Environment
I understand that controls cannot be added to a risk assessment when the RAM is configured to assess risk based on the existing control environment. However, I would like to better understand the rationale behind this limitation. Ideally, we would wa...
New factor in Risk Assessment Methodology (RAM) - Approach
Hi everyone, I am looking to add a new factor and replace an existing one within the Control Assessment section of my Risk Assessment Methodology (RAM). In our Dev environment: I cannot move the RAM back to the 'Draft' state because there are assessm...
