---
sourceDocument: Brazil Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Common controls in Risk Management

# Common controls in Risk Management {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Common controls in Risk Management

In ServiceNow's Risk Management application, common controls enable organizations to centrally manage controls that apply across multiple business units (BUs) or shared functions such as IT, HR, and finance.
By linking risks to these common controls, risk owners can efficiently mitigate risks across reliant entities without duplicating effort.
For example, a fire sprinkler system can serve as a common control for various departments like finance, security, and HR, allowing centralized oversight while benefiting multiple areas.
Show full answer Show less  

## Key Features

* **Centralized Control Management:** Common controls are owned and maintained by a specific department but leveraged by multiple BUs, ensuring consistent policy enforcement and compliance.
* **Automatic Risk-Control Associations:** When control objectives and risk statements align and the reliant entities match, the system automatically establishes risk-control links, reducing manual administration.
* **Inheritance of Common Controls:** Risk owners can inherit common controls in various contexts such as risk records, risk assessments, and risk-mitigation tasks, streamlining control application and testing.
* **Real-time Risk Event Linking:** If a risk materializes into a risk event, the related common control is automatically linked, helping control owners quickly identify failures and respond.
* **Active Relationship Management:** Only active risk-control relationships are maintained; outdated associations are automatically removed to keep data current and relevant.

## Benefits

* **Efficiency:** Reduces time and effort by allowing a single control to be tested and applied across all reliant entities.
* **Improved Reporting:** Managing only active controls enhances the accuracy and clarity of control reporting.
* **Consistent Risk Mitigation:** Ensures risk owners can leverage established controls to reduce duplication and maintain compliance across diverse BUs.  
By linking the risks to a common control in the Risk Management application, you can reduce the time and effort that is needed to manage and apply these centralized controls to your reliant entities. For example, a fire sprinkler system can be a common control for
multiple business units (BUs), such as finance, security, and human resources (HR).

## Overview of common controls {#shared-common-controls-in-risk-management__section_pyv_gm3_dwb}

Every organization has multiple (BUs) and shared functions, such as information technology (IT), HR, and finance. These shared functions define the policies and controls that the BUs can use to meet the regulatory requirements
or to manage the risks in their BUs. Multiple BUs can use common controls that are owned and managed by a different department or team. This process enables an organization to maintain centralized control over certain processes
while each BU can take advantage of these common controls. For more information on common controls, see [Common Controls](https://www.servicenow.com/docs/HIv4PRALzBfUOtIwEUhsVQ "Instead of generating controls for individual entities and testing each entity separately with an individual control, you can use a common control and associate a primary entity to it.").

To mitigate the risks in the reliant entities, a risk owner can link their risks to the common controls. By linking the risk, a risk owner can reduce the effort that is required to attest and test these common controls for the
reliant entities.

## Benefits of common controls {#shared-common-controls-in-risk-management__section_hgg_543_dwb}

A common control has the following benefits:

* You spend less time and effort to manage a common control because you can test and apply a common control to all your reliant entities.
* You only need to manage the active controls, so the overall reporting of the controls is improved.
{#shared-common-controls-in-risk-management__ul_nt5_jq3_dwb}

## Common controls in a risk {#shared-common-controls-in-risk-management__section_uw2_1s3_dwb}

If a control objective and risk statement are associated and the reliant entity of the control matches the risk entity, the risk-control association is established automatically. You can also inherit common controls to a risk when the risk entity is marked as a reliant entity in a common control. Any changes to the risk statement and the control's objective relationship can impact the risk-control association as well. The following example shows the inherit common controls option on the risk form:Figure 1. Inherit common controls  
Note:  
Only active relationships between risks and controls are maintained and any historic relationships are automatically deleted.

## Common controls in a risk assessment {#shared-common-controls-in-risk-management__section_w4v_yb5_fwb}

You can inherit common controls in the risk assessment when the entity is marked as a reliant entity in the common control. The following example shows the inherit common controls option on the risk assessment form.Figure 2. Inherit common controls in risk assessment

## Common controls in a risk-mitigation task {#shared-common-controls-in-risk-management__section_rsr_qb5_fwb}

You can inherit the common controls to a risk-mitigating task when the entity is marked as a reliant entity in the common control. You can inherit the common controls to a risk-mitigating task when it is in the Draft or Work In Progress state. The following example shows the inherit common controls option on the risk-mitigation task form.Figure 3. Inherit common controls in risk-mitigation task

## Common controls in a risk event {#shared-common-controls-in-risk-management__section_imw_sb5_fwb}

A common control is automatically linked to a risk event when the underlying risk has materialized for the risk event. It enables the control owner to identify when the common control fails and to take immediate action if a common control does fail. The following example shows the inherit common controls option on the risk event form:Figure 4. Common controls in risk event