Object-Based RAM on Citation: How to Bring Control Assessments Through Citation → Control Objective

[ShafrazMubarak]

Hi Experts,

I am looking for guidance on a design approach within ServiceNow IRM Risk Assessment Methodology (RAM).

Business Requirement

We are implementing compliance management where:

1. Each Citation is assigned to a Compliance Owning Team.
2. The Enterprise Compliance Team performs an Inherent Risk Assessment on the Citation (Likelihood × Impact).
3. The assessment is then assigned to the respective Compliance Owning Team.
4. The Compliance Owning Team:
   • Reviews the controls mapped to the Citation.
   • Performs Control Effectiveness Assessments on those controls.
5. Based on the Control Effectiveness result, the system should automatically calculate the Residual Risk Score using a lookup matrix defined in RAM.

Current Challenge

We are attempting to use an Object-Based RAM with Citation as the assessment object.

However, during the Control Effectiveness stage, we are unable to bring the relevant controls into the assessment because there is no direct relationship between:

Citation → Control

The relationship exists through:

Citation → Control Objective → Control

My understanding is that some custom logic may be required to traverse this relationship and retrieve the associated controls.

Questions

1. Has anyone implemented a similar Citation-based RAM where control effectiveness is derived from controls linked through Control Objectives?
2. What is the recommended approach to bring the related controls into the assessment?
   • Dynamic filter?
   • Scripted relationship?
   • Assessment indicator source?
   • Custom assessment logic?
3. Is there any out-of-the-box capability in RAM to evaluate controls through indirect relationships?
4. Would it be better to perform the RAM directly on the Control Objective or Control instead of the Citation?

Any guidance, recommended arch