Manage issues
Summarize
Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
Summary of Manage issues
Managing issues effectively is crucial for measuring and improving your company’s risk management program. Issues can be submitted either by employees and business users through the ServiceNow® Service Portal or manually by GRC users within their instance. Additionally, certain issue types such as control issues and control test issues are generated automatically based on control attestations and test results.
Show less
Key Features
- Issue Submission: Two main submission methods—self-identification by employees/business users via the Service Portal, and manual creation by GRC users.
- Automatic Issue Generation: Control issues and control test issues are created automatically under specific conditions without triage.
- Issue Management Goals: Focus on eliminating noise, consolidating duplicates, prioritizing high-risk issues, identifying remediation actions, and analyzing operational weaknesses.
- Issue Lifecycle and Workflow: Includes issue intake, investigation, remediation, and review and monitoring phases to ensure issues are properly addressed and closed.
- Workspace Tracking and Grouping: Ability to track all issues or specific ones from the Workspace, with functionality to group related issues to improve organization and efficiency.
Key Outcomes
By following the issue management workflow, your organization can:
- Ensure timely identification, investigation, and remediation of risk and compliance issues.
- Maintain control compliance and mitigate risks effectively.
- Streamline issue handling by consolidating duplicates and focusing on the most impactful risks.
- Track issue progress and review outcomes to benchmark timelines, identify potential mitigations, and reduce future gaps.
- Use Workspace features to organize and manage issues efficiently, saving time and improving oversight.
You can measure the effectiveness of your company's risk management program by how quickly and completely it identifies and reacts to risk and compliance issues.
Issues can be submitted using two methods, depending on the type of user involved:
- Employees and business users within your company can self-identify an issue and submit it via the ServiceNow® Service Portal. Following submission, a triage issue is automatically created and the issue triage process begins.
- GRC users can manually create an issue from within their instance to document audit observations and remediations, and compliance and risk issues.
Note:
Various types of issues can also be automatically generated under the following
conditions (these types of issues are not triaged):
- Control issue: Created when a control attestation is completed, indicating that the control is not implemented, or when an indicator fails.
- Control test issue: Created when a control test is closed complete with the control effectiveness set to Ineffective.
Goals of issue management
The goals of issue management include:-
Eliminating noise.
-
Consolidating duplicate issues.
-
Focusing on issues that expose the organization to the greatest risk.
-
Identifying and prioritizing remediation actions.
-
Identifying new issues across the business operations.
-
Analyzing operational weakness in policies, processes, and controls.
Issue management workflow and life cycle
By remediating issues, controls can be kept compliant, and risk can be mitigated. The Issue Management workflow and life cycle are illustrated and described here.| Stage | Description |
|---|---|
| Issue intake | As described earlier, issues can be submitted using two methods, depending on the type
of user involved:
|
| Investigate the issue | During the investigation phase, it is determined whether the issue requires additional study. If a triage is being performed, the triage issue is assigned to a triage team for analysis. The triage team may request more information from the issue creator. The team can also optionally send the issue to the compliance manager, risk manager, or triage manager with a triage result. |
| Remediate the issue | After the team has confirmed the issue, the necessary steps to remediate it are performed. If a triage was performed, the triage issue is converted into an actual issue or risk event. The team may also decide to track the issue as a recommendation or close it as a non-issue. |
| Review and monitor the issue | Prior to closing the issue, the policy owner reviews and approves it. The review also
allows the organization to:
|