If you're starting with ServiceNow GRC/IRM, I'd recommend learning the business concepts first and then mapping them to ServiceNow functionality. There are some very good current resources available.
Recommended learning order
1. Understand IRM fundamentals
Start with:
- Risk vs. issue vs. control
- Inherent vs. residual risk
- Risk assessment and scoring
- Compliance vs. risk management
- Control objectives and controls
- Evidence and attestations
2. Policy & Compliance Management
I would start here because it gives you a good understanding of the GRC data model:
Authority Document → Citation → Policy → Control Objective → Control → Control Test → Evidence/Attestation → Issue
ServiceNow's current documentation explains that Policy & Compliance Management manages policies, standards and controls and provides workflows for assessing and monitoring controls.
ServiceNow Policy & Compliance Management documentation
3. Learn Risk Management
Then move to:
Risk Statement → Risk → Risk Assessment → Risk Score → Risk Response → Issue/Remediation
The current Risk Management application covers risk assessments, risk indicators and risk issues, with Risk Workspace available for risk users.
ServiceNow Risk Management documentation
🎥 Excellent current resources
ServiceNow has recently published Speed Learning series for both Policy & Compliance and Risk Management.
The Policy & Compliance Speed Learning series covers authority documents, policies, control objectives, controls, attestations, testing and Compliance Workspace.
Policy & Compliance Management Speed Learning Series
There is also a dedicated IRM Risk Management implementation/video series covering risk identification, assessment and risk profiles.
IRM Risk Management Speed Learning Series
🧪 For hands-on practice
If you have access to an IRM-enabled PDI/non-production instance, don't just read the documentation. Build a small end-to-end scenario.
For example:
Scenario: ISO 27001 Compliance
- Create an Authority Document.
- Add a Citation.
- Create a Policy.
- Create a Control Objective.
- Create a Control.
- Define the Control Owner.
- Create a Control Test.
- Collect/attach Evidence.
- Run the assessment.
- Make the control fail intentionally.
- Generate an Issue.
- Assign remediation.
- Resolve the Issue.
- Run the control test again.
- Build a dashboard showing compliant/non-compliant controls.
This will teach you much more than simply going through the menus.
ServiceNow's current documentation also explains that controls can be automatically generated when policies/entity types are associated with control objectives, which is an important concept to understand when you get beyond basic configuration.
🔧 Then learn the technical side
Once you're comfortable functionally, start looking at:
- IRM tables and relationships
- Roles and ACLs
- Reference qualifiers
- Data model
- Flow Designer
- Notifications
- Scheduled jobs
- Script Includes
- Assessment engine
- Control testing
- Evidence collection
- Risk calculation/scoring
- Workspaces
- Reports and Performance Analytics
- Integrations
This is where you transition from "I know how to use IRM" to "I can implement and troubleshoot IRM."
📚 ServiceNow University
I'd also strongly recommend using ServiceNow University/Now Learning rather than relying only on YouTube. ServiceNow currently has dedicated GRC learning paths, including Risk & Compliance implementation paths.
ServiceNow Learning Paths
One particularly useful progression would be:
IRM Fundamentals → Policy & Compliance → Risk Management → Controls & Assessments → Advanced Risk/IRM → Technical implementation
Don't try to learn VRM, BCM, Audit, Regulatory Change, etc. at the beginning. Get strong in Policy & Compliance + Risk Management first; they're the best foundation for understanding the rest of IRM.
Also, since you're interested in both functional and technical knowledge, I would keep two parallel tracks: "What business problem does this solve?" and "Which ServiceNow table/flow/role/configuration makes it work?" That combination will be particularly valuable when you start working on real implementations.
