IRM/GRC - Associating Controls with Business Applications/ Business Processes

[KshitijaS]

Hi All,

I'm looking for some clarification on best practice around associating Controls with business applications and business processes in IRM.

* Can I associate Controls directly to business applications or business processes core tables by adding a related list?

* Or is it necessary/best practice to use the Entity framework and create business application entity and business process entity and then associate controls with those entities instead?

From what I understand, servicenow recommends linking GRC objects like controls, risks, issues, policies to entities rather than to standalone or foundational tables. 

Any guidance or real world experience would be much appreciated!

Thanks,

K**bleep**ija

[Matthias Ferstl · Accepted solution]

Hello @KshitijaS 

stay with the entity framework. This build a fundament on which GRC functions (in fact the whole framework) is built on.

Assigning controls to the core table is like adding a gear to a car without engine.

So it is not only "best practice" but necessary. Everything else would break the framework and functions you / the customer will need.
If you have any further questions, let me know.