Using Entities

[Carlos58]

Hello. We are implementing IRM globally. We have consider naming each geographic location, and each Legal Entity (company), as an entity in IRM; however, it looks like many of you use entities for business functions, processes, even applications.  It looks like you can use entities for anything where you might need to group risks. Is this correct? Can you share how do you use entities in your organization?

[SanjivMeher]

It completely depends on how your organization functions. We created entities based on business functions. Sometimes based on teams. We haven't created entities for each and every functions. We only created when we have a control needs to be assigned to a team/function. We have not created any upstream or downstream relationships between the entities. But you can do that too, which can tell what is the impact to other entities when a downstream entity is non-compliant or has a risk associated to it.

Some companies also creates entities using entity filter, which creates entities under entity type automatically. This helps when you don't want to create entities manually when a new function is created.

[dmathur09]

Hi Carlos,

Entity is the most granular piece of IRM. Entity can be anything that you want to held accountable on. Entities can be people, processes, departments, applications, or objects. Though each Entity should have a owner.

Generally Entity Filters are been used such that new Entities are created own its own when a new record is created on that particular table. This will automate the process and ease your efforts.

We have both mix of Adhoc entities and entities that are created by referring to a Servicenow record using Entity filter.

Regards,

Deepankar Mathur