GRC compliance issue

[PrabuRadhakris]

When a risk or an exception is approved for a issue, should we close the issue or leave it in response status ? if we can close the issue then what status it should be closed as - Closed complete, Closed-incomplete? Please share any relevant document that I can refer to learn the whole workflow based on best practice / recommendation from ServiceNow.

[SohamTipnis]

Hi @PrabuRadhakris,

You can use this documentation for your GRC module; this will help you not just for this question but also in the coming future as well. Good luck. 👍

If you find my answer useful, please mark it as Helpful and Correct ‌😊

Regards,
Soham Tipnis
ServiceNow Developer ||  Technical Consultant
LinkedIn: www.linkedin.com/in/sohamtipnis10

[SohamTipnis]

@PrabuRadhakris 

Use this ppt for your current requirements.

If you find my answer useful, please mark it as Helpful and Correct ‌😊

Regards,
Soham Tipnis
ServiceNow Developer ||  Technical Consultant
LinkedIn: www.linkedin.com/in/sohamtipnis10

[Aditya_hublikar]

Hello @PrabuRadhakris ,

Once a Risk Acceptance or Exception is approved, the organization has formally decided not to remediate the issue at this time. Issue should be closed as Closed – Complete, since the organization has formally accepted the risk and no further remediation is required. we keep issue as closed-incomplete when it requires remediation, means we didn't accept risk.

You can also refer this issue management document :

https://mynow.servicenow.com/now/best-practices/assets/grc-issue-management-process-guide

Best practice for Policy and compliance 

If this helps you then mark it as helpful and accept as solution.

Regards,

Aditya

[Aditya_hublikar]

Hello @PrabuRadhakris ,

 I hope you are doing well . Does my response helps you ?

If my response helps you then mark it as helpful and accept as solution.

Regards,

Aditya