FYI - Entity Owner bug in GRC: Policy and Compliance Management 20.1.3

[Louise VA]

Be advised that the latest version of GRC: Policy and Compliance Management has a bug in it where if more than one Entity is created at the same time (at least from the same Entity Type filter, haven't tested other scenarios), the Entity Owner for all created will be the same as the first Entity created. 

This is being caused by the GRCUtilBase Script Include, specifically the _generateProfilesFromType function. I have created a workaround by overloading the function in the GRCUtil script include and changing this line:

profAppliesToSysIdToOwner[gr.sys_id] = owner;

to:

profAppliesToSysIdToOwner[gr.sys_id] = owner.getValue('sys_id');

[danmjunqueira]

Thank you for sharing this detailed and valuable insight.

This kind of bug—where the same owner is mistakenly applied across multiple entities—can cause major governance and reporting inconsistencies, especially in large-scale GRC implementations. It's great that you identified the root cause in _generateProfilesFromType and provided a clear workaround using owner.getValue('sys_id').

For others dealing with similar issues, I’d recommend the following:

Review any batch entity creation activities since deploying 20.1.3 to ensure ownership has been set correctly.

Temporarily override the GRCUtil script include as suggested until an official patch is released.

Log a support case with ServiceNow referencing this behavior to help increase visibility and expedite a formal fix.

If your environment has automated entity/profile generation (via Entity Scoping Rules or integrations), it's worth validating the impact there as well.

Thanks again for raising this—definitely worth noting for anyone managing GRC at scale.

[GouthamAnumolu]

@Louise VA  @danmjunqueira  here is the KE with the workaround for the issue.

https://support.servicenow.com/kb?sys_kb_id=51b03790471a2290b6d8aa25126d43c3&id=kb_article_view