Hello ServiceNow GRC Community,As a newcomer to ServiceNow GRC, I've been exploring the modules such as Policies, Risks, Controls, Issues, Policy Exceptions, Remediation Tasks, and Audits. While I've grasped the basic lifecycle stages of these compon...
Hi folks - Trying to understand - how risk and control are linked. For example - let's say a risk is evaluated and a mitigating control is added, still the residual risk remains the high it doesn't change why?.Secondly, when a control is moved from ...
Hi! Has any of you encountered the following problem with the acl:s in the sn_risk_risk -table? When a user who has no valid role tries to access the table using the command sn_risk_risk.list in the application navigator, the expected prompt appears:...
Currently I am working on the GRC feature 'Policy authoring and redlining in Compliance Workspace' which requires O365 integration. I have completed the below steps so far Have integration Hub entitlements Installed Compliance Workspace Installed Mi...
I have a requirement:-In Business Impact Analysis(BIA) form there is a field "Recovery Time Objective(RTO)" , if RTO value less than 48hrs, BIA to go for approval to XYZ team. A mail to be triggered to XYZ team for approval.Team can approve / reject...
Hi all, I'm configuring Audit Workspace, but this question is similar to every workspace. For example I open Audit Workpace, check all engagements from list view. I can see that there is OOB "Select all" checkbox next to name. When I click it all eng...
Hello everyone,I have recently delved into the ServiceNow GRC module, exploring its various applications such as policy, control, issue, risk, and more. After installing all the plugins, I am now eager to implement GRC in my ServiceNow PDI and seek r...
Hello Team,Has anyone implemented UCF to Service-now Integration Or LexisNexis to Service-now Integration.We are just collecting data points to compare which is better among the two or which one has better interface, any pros and cons after implement...
Hello,A client is asking for a policy exception at the indicator level. Is there any option to achieve the same knowing that in OOB policy exception is managed at the policy, control objective, control and issue levels. Thank you
Hello All,I would like to know if we can use after/update BR to update substate field on change request form based on the fields on change_task also would like to know the trigger condition and table for the sameI am assuming table will be change_Req...
Hello,Does the exempt flag make the control as 'not applicable'? or it only skips the attest state?To give more context, I would like to make some controls as 'not applicable' without using the policy exception workflow. So i'm looking for an easier ...
In current IRM setup, Entity owner is global across the board which we can understand from reporting perspective. However, Control objective owners are tied to the entity owners by default which is not common across industry. To explain more see bel...
Hi Team, I need your help in adding reports in Issue Overview Tab in Compliance and Risk Workspace. I want to add report like in column as well as in row. But when i am trying to create the report it is coming either column wise or row wise as belowI...
Hello,I'm currently working on audit management module and some concepts are confusing :1.What is the use case for creating an auditable unit and what the different with scoping an entity? 2.What is the difference between test template and test plan?...
Greetings, In one of our custom apps, we have several situations where we have forms from a Task-extended table that have Embedded/Related lists. In general, most users should have read-only access to records in the tables represented by those lists....
