How attestation and indicators are different ?

gourav_aggarwal · ‎08-27-2025

They seem to have same purpose that is providing evidence for particular control.

Shashank_Jain · ‎08-29-2025

Feature Attestation Indicator

Source of evidence	People (subjective response)	Data/system (objective, measurable)
Use case	Formal confirmation, surveys, approvals	Continuous monitoring, automated evidence
Trigger	Manual / scheduled campaign	Scheduled job or real-time metric
Example	"Manager confirms access review complete"	"Report shows 10 users without review approval"

✅Summary:

Attestation = human-driven, subjective confirmation.
Indicator = system/data-driven, objective measurement.

They complement each other: some controls require human attestation, while others can (and should) be monitored by indicators for continuous assurance.

Hope it helps!

If this works, please mark it as helpful/accepted — it keeps me motivated and helps others find solutions.
Shashank Jain

View solution in original post

Bhuvan · ‎08-27-2025

@gourav_aggarwal

See if below link and PDF document helps,

https://www.servicenow.com/community/grc-forum/control-and-risk-indicators/m-p/1310558

https://www.servicenow.com/community/s/cgfwn76974/attachments/cgfwn76974/governance-risk-compliance-...

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

Bhuvan · ‎08-27-2025

@gourav_aggarwal

Did you get a chance to review this ?

If my response helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

Bhuvan · ‎08-29-2025

@gourav_aggarwal

Thanks for marking the post as helpful.

If this helped to guide you or answer your query, please accept the solution.

Thanks,

Bhuvan

Bhuvan · ‎08-30-2025

@gourav_aggarwal

Did you get a chance to review this ?

As per community guidelines, you can accept more than one answer as accepted solution. If my response helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan