Best way to gather evidence for Control?

[vineethnair]

Hello,

When a create an audit workbench defining the scope of the audit by including the profiles, controls, risks etc. What is the best way to ask all the control owners to ask for evidence during that point of time? I am aware of the functionality where we can generate control tests based on the test plans associated with the controls. As an organization, we are not yet mature in maintaining test plans for each and every control documented within service now. Is there a functionality to generate attestation survey in bulk to all the control owners ? Similarly to the "Attest" button functionality available on the Controls.

Thanks.

[Syra Arif]

Correct, take a look at this: GRC continuous monitoring

[mdeandrea]

Can you explain how you can generate a single attestation that covers multiple controls as stated below:

"This can then to be tied to controls in order to execute an attestation survey that covers many controls at once."

My understanding is that there is one attestation for each control and that attestation is generated when the control moves from draft to attest.  

Thanks you for your help.

[mdeandrea]

Can you please explain how to create "a single attestation that covers many controls at once?"   As   I understand it, Iou can create an attestation that   can then be attached to many controls.   But, when you move any of those controls from DRAFT to ATTEST, the system generates an attestation for each control you moved.   So, the end result is that you get many attestations -- not a single attestation that covers many controls at once, correct?   I'm hoping I'm wrong in my understanding and that there is indeed a way to "create a   single attestation that covers many controls at once."   Would really like to be able to do that.   Can you please show me how you do it?

[cbryant]

Did you ever get an answer?   Thanks.

[mjdeandrea]

No, I haven't. You can create a single attestation and associate it to a Policy Statement.   Then every control generated from that Policy Statement will have the selected attestation associated with it.   But you still end up with one attestation for every control.-- not one attestation that covers many controls.