Difference between "Risk Event" (Advanced Risk) and "Compliance Case Management" (GRC)

[莉奈明]

Hello Community,

I'm trying to understand the core differences between two functionalities within ServiceNow GRC:

・"Risk Event" from Advanced Risk
・"Compliance Case Management" from GRC

From my perspective, while the detailed statuses might differ, the general workflow for both seems similar to incident management: "Create a case (Risk Event/Compliance Case) → Handle tasks at the Investigation/Analysis status  → Close." So, I'm looking for a clearer understanding of their primary differences in usage and purpose.

Could anyone tell me how these two features are distinctly leveraged within an organization's GRC framework? For example, when would you specifically use Risk Events versus Compliance Case Management?
Any insights or examples would be greatly appreciated!

Thank you.

[HenkHeath]

Hello @莉奈明 

Lets assume the Risk & compliance environments are in place and all is well.  Risks are assessed, controls are attested.......we have a Happy Environment.

Entity - Office Building

Authority Document - Government mandated office hours

Citation xxx.xxb - You must have a 24 hour per day Operational presence at the office

Risk Statement - Power Failure

Control Objective - Uninterrupted power Supply

     - Control Objective - Solar Power

     - Control Objective - Backup Power

We have a low risk, as we have mitigated our Municipal power supply interruption risk by adding Solar power and a backup diesel generator.

Just because the risk is mitigated, does not mean it cannot manifest within the organisation.  In the event that we do have a power failure - A risk has materialised -> Risk Event.

We now treat the event and ensure we remediate the situation (Quick Response) - Risk Event Response

Because of the event, we have not kept our Regulatory compliance.....We are in possible breach of our obligations.

Which control failed to mitigate our Risk?  

• Day time - Solar not operational?  Cloudy for the last week? no Solar Power.
• At night - Diesel generator did not start up?
• Fuel was checked (or was it?) 
• Was the fuel dirty and the generator could not start up? even though there was enough fuel in the fuel tank.

We create a Compliance case to determine if we have breached our obligation, and which one caused the risk to manifest.  We also have to determine if we need to report the breach to the Authority. 

This is usually be a long, drawn out situation where communication between the company/lawyers and the Regulating body could take years. 

Risk Event - Record, remediate quickly to ensure it does not happen again

Compliance Case - investigation / Explanation to the Authority as to why it happened, who was impacted, what did we do to remediate, and how did we strengthen our environment so that it does not happen again.  Could resolve over a long period.

[莉奈明]

Hello　@HenkHeath 

Thank you for your quick response!
I understand that there are differences in the issues adressed and management objectives between them.

・Risk Events: These are for recording actual risks such as data breaches and system failures, focusing on corrective actions and prevention of recurrence after an event occurs.
・Compliance Cases: These are for managing violations of regulations and policies, such as security regulation breaches or harassment incidents, aiming to address the compliance risks associated with these violations.

Thank you.