Object-Based RAM on Citation: How to Bring Control Assessments Through Citation → Control Objective

[ShafrazMubarak]

Hi Experts,

I am looking for guidance on a design approach within ServiceNow IRM Risk Assessment Methodology (RAM).

Business Requirement

We are implementing compliance management where:

1. Each Citation is assigned to a Compliance Owning Team.
2. The Enterprise Compliance Team performs an Inherent Risk Assessment on the Citation (Likelihood × Impact).
3. The assessment is then assigned to the respective Compliance Owning Team.
4. The Compliance Owning Team:
   • Reviews the controls mapped to the Citation.
   • Performs Control Effectiveness Assessments on those controls.
5. Based on the Control Effectiveness result, the system should automatically calculate the Residual Risk Score using a lookup matrix defined in RAM.

Current Challenge

We are attempting to use an Object-Based RAM with Citation as the assessment object.

However, during the Control Effectiveness stage, we are unable to bring the relevant controls into the assessment because there is no direct relationship between:

Citation → Control

The relationship exists through:

Citation → Control Objective → Control

My understanding is that some custom logic may be required to traverse this relationship and retrieve the associated controls.

Questions

1. Has anyone implemented a similar Citation-based RAM where control effectiveness is derived from controls linked through Control Objectives?
2. What is the recommended approach to bring the related controls into the assessment?
   • Dynamic filter?
   • Scripted relationship?
   • Assessment indicator source?
   • Custom assessment logic?
3. Is there any out-of-the-box capability in RAM to evaluate controls through indirect relationships?
4. Would it be better to perform the RAM directly on the Control Objective or Control instead of the Citation?

Any guidance, recommended arch

[benjamining]

I think the key point here is that this is primarily a limitation of the Object-based RAM context, rather than simply a missing Citation → Control relationship.

ServiceNow's documentation for Any Object Assessment specifically notes that controls cannot be assessed as part of an Object-based risk assessment because controls are associated to either an Entity or a Risk. The risk response workflow is also unavailable when assessing an object.

So if Citation is selected as the assessment object, I would be cautious about trying to solve this through a dynamic filter or scripted relationship. You may be able to build custom logic to traverse Citation → Control Objective → Control, but you would effectively be extending RAM beyond the supported Object-based assessment model.

There is, however, a newer capability that may help with part of the requirement.

ServiceNow provides an Enable association of Citations to controls Mapping property under Policy and Compliance. Once enabled, it introduces a direct Citation-to-Control association and displays the associated Controls as a related list on the Citation. ServiceNow uses the sn_compliance_mtm_citation_control table for this relationship.

Importantly, the eligible Controls include those generated from Control Objectives directly associated with the Citation, as well as Controls from child Control Objectives. This effectively gives you the traceability you are currently trying to achieve through Citation → Control Objective → Control directly at the Citation level.

That still doesn't make those Controls available for automated control assessment within an Object-based RAM. The RAM limitation remains.

However, it could provide a reasonable compromise if the business process can accommodate some judgement:

Citation → direct view of applicable Controls → review Control effectiveness/results → informed assessment of the control environment → determine Residual Risk

In other words, the assessor could directly see the Control instances relevant to that Citation and use their current effectiveness as evidence when making a subjective control environment assessment within the RAM. What you would lose is the OOTB automated calculation of residual risk based on those Control assessments.

If the requirement is specifically that ServiceNow must automatically evaluate the applicable Controls and derive Residual Risk from their effectiveness, I would still favour performing the RAM against a Risk or Entity, where that relationship is supported OOTB.

If the requirement is instead that the Compliance Owning Team needs to understand the effectiveness of the Controls supporting each Citation and use that information to determine Residual Risk, then Citation-based Object RAM + direct Citation-to-Control mapping may be a reasonable design with considerably less customisation.

Hope this helps!