Control and Indicators

[shweta khemani]

Hi All,

I am learning the IRM course and I have a query on the below aspect.

I understand that it is possible that without measuring control the indicators can be created for entity, may I know is that the right way it should work or logically we should not follow this path?

So, even if the control is in 'Draft' stage, I can still create control indicator for the same and which in turn creates indicator task.. Doesn't we should wait for the control to move to 'Monitor' stage before creating indicators?

What is the right flow. Please guide.

Thanks

[Abhay Kumar1 · Accepted solution]

@shweta khemani In Integrated Risk Management (IRM), the flow and logic for creating control indicators depend on how your organization defines its risk and compliance processes. Here's an explanation and best practice guidance:

---

How It Works:

Control Indicators: These are metrics or measures used to assess the effectiveness of controls. They can be created at any stage of the control lifecycle.

Draft Stage: While a control is in the Draft stage, it's typically not finalized or implemented. However, ServiceNow allows creating control indicators during this stage.

Monitor Stage: Controls in the Monitor stage are actively implemented and ready for assessment. This stage is the most logical time to start using control indicators and generating indicator tasks.

Why Indicators Can Be Created in Draft:

Flexibility: ServiceNow allows flexibility in process design. This enables users to define control indicators early, even in the Draft stage, for planning purposes or as part of a larger control framework.

Iterative Development: In some organizations, controls and indicators are developed iteratively. Setting up indicators in the Draft stage might help refine the control during its lifecycle.

Avoid Wasted Effort: Indicators created prematurely (in the Draft stage) might lead to redundant or invalid indicator tasks if the control undergoes significant changes.

Hope this will help you.