--- sourceDocument: Brazil Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Compliance case workflow # Compliance case workflow {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Compliance Case Workflow The Compliance Case Management workflow in the GRC application enables ServiceNow customers to efficiently report, manage, investigate, resolve, and close compliance cases requiring the compliance team's attention. It structures the compliance case lifecycle into distinct stages, ensuring thorough handling from initial report through closure. Show full answer Show less ## Workflow Stages * **Report a compliance case:** Business users or compliance teams can report compliance violations via the Employee Center or Compliance Workspace applications. * **Triage the compliance case:** The compliance team validates the reported case and assigns a case analyst to manage the investigation. * **Investigate and evaluate the compliance case:** The case analyst collaborates with multiple teams to gather evidence and details. They create and assign case tasks, review responses, and document impacted areas (entities, controls, locations, users), related areas (policies, citations, control objectives, risk events), relevant compliance regulations, and causes and consequences (root causes and organizational impact). * **Resolve the compliance case:** The case analyst initiates remediation and preventive actions, and tracks any regulatory violations for reporting to regulators. * **Post case review and closure:** The analyst performs root-cause analysis to eliminate causes, manages related issues, and collaborates with teams to review and formally close the case. ## Key Benefits * Provides a structured, repeatable process for managing compliance cases to ensure thorough investigation and resolution. * Enables clear assignment and collaboration across teams through case tasks and roles. * Supports comprehensive documentation of impacted and related areas, compliance regulations, and root causes for compliance cases. * Facilitates regulatory reporting and helps prevent recurrence through remediation and preventive measures. * Promotes continuous improvement by incorporating post-case reviews and issue management. The workflow in the Compliance Case Management application is a process that enables you to report and manage cases that need the compliance team's attention. The following diagram shows the workflow of the GRC: Compliance Case Management application.Figure 1. GRC: Compliance Case Management workflow The different stages of the workflow are described as follows: * Report a compliance case * Triage the compliance case * Investigate and evaluate the compliance case * Resolve the compliance case * Post case review and closure {#compliance-case-management-workflow__ul_kft_25m_mwb} ## Report a compliance case {#compliance-case-management-workflow__section_nwq_5vg_cwb} A business user or a compliance team can report a compliance violation in the Employee Center application. Compliance case team can report cases in the Compliance Workspace application. For more information, see [Reporting a compliance case in GRC: Compliance Case Management](https://www.servicenow.com/docs/so0Fcra3wvr8NwAiQXCh1w "You can report a compliance case or an event that needs the attention of the compliance team by using the GRC: Compliance Case Management application."). ## Triage the compliance case {#compliance-case-management-workflow__section_jlq_dts_cwb} After a compliance case is reported, the compliance team triages the case from a validity standpoint. The team then assigns a case analyst to work on the case. ## Investigate and evaluate the compliance case {#compliance-case-management-workflow__section_st3_dy5_cwb} The compliance case analyst collaborates with multiple teams to investigate, gather evidence, and capture the details and responses about the case. Then, the case analyst creates the case tasks to initiate an investigation and assessment of a reported case and assigns them to a case task owner. The case task owner adds the requested details and submits them to the case analyst for review. Based on the investigation and assessment responses, the case analyst performs the following tasks: * Add the areas that are impacted by a compliance case. For example, the impacted areas or records that could be impacted are the entities, controls, locations, or users that are affected by the compliance case. For more information, see [Add an impacted area to a compliance case](https://www.servicenow.com/docs/ps6eC_AYrgariGoHrgsS5g "Add an impacted area or object that is affected by the compliance case or event in the GRC: Compliance Case Management application."). * Add the areas that are related to the compliance case. For example, the related areas include the policies, citations, control objectives, or risk events. For more information, see [Add a related area to a compliance case](https://www.servicenow.com/docs/NrIB0VJijpFZJmP9~Sj1rQ "Add an area that is related to the compliance case or event that is reported in the GRC: Compliance Case Management application."). * Add the compliance regulations that might be impacted by the compliance case. For more information, see [Add compliance regulations to a compliance case](https://www.servicenow.com/docs/VBjNUGBr9kd29Exrd7dpZw "Add the regulations that are or can be impacted by the reported compliance case. In the ServiceNow platform, regulations are captured as authority documents. Adding the regulations to the case enables you to identify which regulations are breached or violated and prevents your organization from getting penalties or fines for this case."). * Add the causes and consequences of this compliance case such as the root cause for the reported compliance case or event and its consequences to the organization. For more information, see [Add a cause and consequence to a compliance case](https://www.servicenow.com/docs/_PaYh2UwnOh5J~sISlOJng "Define the root cause for the reported compliance case or event and its consequences on the organization by using the GRC: Compliance Case Management application."). {#compliance-case-management-workflow__ul_hzs_3jv_cwb} ## Resolve the compliance case {#compliance-case-management-workflow__section_tsd_y3v_cwb} After all the analysis for the reported case is completed, the case analyst initiates the remediation actions and preventive measures to resolve the case. The case analyst also tracks the reportable regulatory violations to ensure their lodgement to the regulators. ## Post case review and closure {#compliance-case-management-workflow__section_jww_fpv_cwb} The case analyst analyzes the causes and consequences of the case. Then, the case analyst​ conduct​s a root-cause analysis to remove the cause of the case. The case analyst can review the case to identify and manage the issues that are related to the impacted areas. For more information, see [Add an issue for a compliance case](https://www.servicenow.com/docs/M44iF8bMoVl7go7uvufvMg "Identify and add an issue that is related to the impacted areas of a reported compliance case. You can also create an issue from the GRC: Compliance Case Management landing page."). Finally, the compliance analyst works closely with the various teams to review and close the compliance case.