Is it possible to connect citation to Controls & Business processes in Risk Workspace (IRM)

[KshitijaS]

Background -

In my company's servicenow instance, the Risk Workspace has been configured and the Policy and Compliance workspace is planned for a future phase, but currently, we are focused on merging SOX- related controls, risks, business apps, business processes into Risk Workspace.

Current Ask from Business:

The SOX team has requested the following capabilities:

1. Ability to connect Issues to Authority documents via related list

2. Ability to related Policies, Controls and business processes to Citations/Authority documents via related lists

My observations:

* I see that at the Issue level, servicenow provides an Authority Document related list OOB

* However, there is no related list for Citation, Control Objective or Authority document on the Control level or under Business processes in the Risk workspace library.

* Similarly, in the Business process records, I dont see citation, authority document or control objective in the related list.

Since business does not want to wait for the Policy and Compliance workspace setup and needs this capability now for SOX, I'm wondering : Is it recommended to build direct relationship via related lists or M2M tables between controls and citation, between business processes and citation?

or would it be better to maintain this mapping through control objectives or wait for the Policy and compliance workspace?

Appreciate your guidance on the best approach.

Thanks

[himanshi24]

Yes as per the Zurich release we can add  directly linking controls to citations.
sn_compliance_mtm_citation_control in ServiceNow