---
sourceDocument: Zurich Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Manage control objectives and policies

# Manage control objectives and policies {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Manage control objectives and policies

The Policies and Procedures module in ServiceNow provides comprehensive management of policy approvals, policies, and control objectives.
It offers an executive dashboard that highlights compliance requirements, overall compliance status, and areas of concern to help compliance administrators and managers monitor and manage compliance effectively.
Show full answer Show less  

## Key Features

* **Policies and Procedures Overview:** Includes visual reports such as donut charts, column charts, line charts, and lists that display control compliance, control breakdowns, control issues, policy exceptions, and counts of control objectives by policy.
* **Policy Approval Process:** Policies go through defined states---Draft, Review, Awaiting Approval, Published, and Retired---to ensure thorough review and validation. Compliance managers control policy validity periods, and policies are automatically published to knowledge base articles once approved.
* **Policies:** Compliance managers catalog and publish internal policies that define business processes, procedures, and standards.
* **Control Objectives and Requirements:** Control objectives guide company operations and can be related to policies and citations from authority documents. Control objective requirements specify granular compliance conditions, and control requirements can be automatically generated for each control objective requirement.
* **Attestation at Control Requirement Level:** Enables detailed attestation for individual control requirements, with the ability to assign respondents and generate assessment tasks. Failed attestations generate issues and mark controls as non-compliant, affecting related entities and objectives.
* **Policy Lifecycle Actions:** Users can create, approve, publish, acknowledge, and retire policies. Acknowledgement campaigns help ensure employees confirm compliance with published policies.
* **Content Management:** Allows creation and management of GRC article templates, authority documents, citations, and control objectives. Items can be activated or deactivated as needed to maintain relevance.

## What This Enables You To Do

ServiceNow customers can use this module to efficiently manage and enforce compliance policies and control objectives, track their approval status, and maintain governance documentation in a structured and automated manner. The granular attestation and reporting features help identify compliance gaps early and ensure continuous alignment with business and regulatory requirements.

## Practical Outcomes

* Streamlined policy approval and publication process with automated knowledge base integration.
* Comprehensive visibility into control compliance and issues to enable proactive risk management.
* Ability to map control objectives to multiple citations and authority documents for multi-regulation compliance.
* Granular control of compliance attestations at the requirement level, improving audit readiness.
* Effective lifecycle management of policies, controls, and related documentation to keep compliance programs current and actionable.  
The Policies and Procedures module contains overview and detailed information related to policy approvals, policies, and control objectives.

## Policies and Procedures Overview

Policies and Procedures Overview is contained in the Policies and procedures module and provides an executive view into compliance requirements, overall compliance, and compliance breakdowns so areas of concern can be identified quickly. Users with the compliance administrator and compliance manager roles view the Policies and Procedures Overview.{#r_PoliciesAndProcedures__table_p_and_p_overview__entry__3}

| Name | Visual | Description |
|-|-|-|
| Control compliance | Donut chart![Donut icon]() | Displays the overall compliance of all the controls in the system. |
| Control details | Donut chart![Donut icon]() | Displays a breakdown of controls grouped by owner, category, or type. |
| Control Overview | Column Chart![Column icon]() | Displays the total number of controls related to each policy. The chart is stacked to display the overall control compliance status for each policy. |
| Control Issues by Policy (Opened Date) | Line Chart![Line icon]() | Displays the number of control issues opened each week, grouped by policy. |
| Policy Exceptions | List | Displays a list of control issues that have been closed with a response value of accept, meaning the issue was not remediated. |
| Total Control Objectives by Policy | Bar graph | Displays a count of the overall number of control objectives in each policy. The chart is stacked to display control objectives by type. |
[Table 1. Policies and Procedures Overview reports in the base system]

{#r_PoliciesAndProcedures__table_p_and_p_overview}

## Policy approval process

Policies are part of a strict approval process that ensures compliance and reduces exposure to risk. When a policy is published, it is automatically incorporated in the approval process. Compliance managers set the length of
time that policies are valid, ensuring that the team reviews the policy often to affirm its validity. Policies have a type, such as a policy, procedure, standard, plan, checklist, framework, or template.  
{#r_PoliciesAndProcedures__table_amh_4kb_cv__entry__2}

| State | Description |
|-|-|
| Draft | All policies start in Draft state. In this stage, all compliance users can modify the policy and control objectives. |
| Review | The owner, owning group, and reviewers can modify the policy and control objectives and send it on to the next state. |
| Awaiting Approval | The policy is read only in this state. Approved policies transition to the Published state. Unapproved policies return to Review. If no approvers are identified on the policy form, the state is skipped and the policy is published without an approval. |
| Published | Approved policies are automatically published to a template-defined KB article, and the policy remains in a read-only state. The Valid to field on the policy form defines how long the policy is valid. Note: After the policy is published and when the valid to date on the policy is reached, then based on the value of the Number of days after reaching a policy "Valid to" date in which the expired policy will automatically move from its Published state back to a Draft/Review state property, the policy moves back to the Draft/Review state. For example, if the value of the property is 10, then the policy moves back to review state 10 days after the valid to date is reached. When a policy reaches the end of the Review state and is Approved for publishing, it is automatically published to the GRC knowledge base (as defined in Policy and ComplianceAdministrationProperties. The Article template field on the policy form defines the style of the published policy. |
| Retired | When a policy is put into the Retired state, its associated KB article is removed. |
[Table 2. Policy approval states]

{#r_PoliciesAndProcedures__table_amh_4kb_cv}

## Policies

Compliance managers catalog and publish internal policies that define a set of business processes, procedures, and or standards.

## Control objectives

Compliance managers catalog the control objectives and generate controls from those control objectives.  
Note:  
UCF refers to control objectives as controls. When UCF data is imported, controls are imported into the control objectives table.

## Control objective requirements {#r_PoliciesAndProcedures__section_vlv_t1x_mhc}

A control objective requirement is a granular layer under a control objective that specifies a distinct compliance condition or expectation. Each control objective can have multiple statements, and each statement becomes a
control objective requirement.

When control objectives are imported, if any control objective requirements are available in the source, they will also be imported with the control objective.

Control objective requirements can also be manually added or selected from existing requirements when configuring a control objective.

When controls are generated under an entity, the control objective requirements help create corresponding control requirements.

## Control requirements {#r_PoliciesAndProcedures__section_smt_b3y_mhc}

When Create control requirements option is enabled for a control objective, for every control generated under an entity type, control requirements are also created automatically. Previously, only controls were created for entity
types. The number of Control Requirements equals the number of control objective requirements.

## Attestation at control requirement level {#r_PoliciesAndProcedures__section_u13_44y_mhc}

This feature allows attestation at a granular level for individual control requirements within a control. Admins can enable requirement-level attestation, assign respondents, and generate assessment tasks for each control
requirement. Respondents then attest to requirements by indicating whether they are implemented or not, providing evidence or explanations as required. Failed attestations automatically generate issues, mark the parent control
as non-compliant, and roll up the status to the associated entity and control objective.
* **[Create a policy](https://www.servicenow.com/docs/Zi7sOQRyeOSkNzTutn6r5Q)**   
  A policy defines an internal practice that processes must follow. Policies are defined as policies, procedures, standards, plans, checklists, frameworks, and templates.
* **[Approve and publish a policy](https://www.servicenow.com/docs/Y3N_DiGcSHBjasyIqhHFEg)**   
  When a policy is approved, it is automatically published.
* **[Acknowledge a policy](https://www.servicenow.com/docs/5sRO6Yqlj_nIDPWngfZIIQ)**   
  After a policy has been published, you can create an acknowledgement campaign to define a group of your employees who must provide an acknowledgement that a particular policy is in compliance. When the campaign has been defined, you can submit the request to the audience.
* **[Retire a policy](https://www.servicenow.com/docs/SWN~7byxT5QONaDi5aOobQ)**   
  Retiring a policy is part of the policy management process.
* **[Create a GRC article template](https://www.servicenow.com/docs/r_1tFGR5GHV38F1hM3be~w)**   
  Policy and Compliance managers can create templates for policy article publishing.
* **[Create a control objective](https://www.servicenow.com/docs/BE0aspxebr1P4bBFbVx6ZA)**   
  A control objective is an objective, direction, or standard that acts as guidance for company interactions and operations. Control objectives can be categorized, classified, and related to policies.
* **[Deactivate a control objective](https://www.servicenow.com/docs/HGos792oRAvZYlGSYX9l8w)**   
  Deactivate control objectives that are no longer relevant to their citation or parent control objective.
* **[Relate a control objective to a policy](https://www.servicenow.com/docs/QmtHKZ1NHpVaU5OxaCKCCQ)**   
  Associate the control objective to a policy individually when the policy is in the review or draft state by clicking the edit button in the Control Objective related list.
* **[Relate a control objective to a citation](https://www.servicenow.com/docs/b55275DYuz8hsCRKuzVPUg)**   
  A single control objective can be mapped to many citations from different authority documents. This function allows you to test a control objective once while complying with many different citations.
* **[Create or deactivate a citation](https://www.servicenow.com/docs/BUpS7J2ezOiOz9pM8G4ZTw)**   
  Usually, authority documents, citations, and control objectives are downloaded from a third-party provider. However, citations can be created manually from an authority document. The Active option in a citation indicates whether the citation is active or inactive.
* **[Create an authority document](https://www.servicenow.com/docs/Rr6bSkHXWbOFLtsb7kCAaw)**   
  Authority documents manage a process and citations are created within them to manage points of the process. For example, the process called Building Security contains a citation for Entry Control.
* **[Deactivate an authority document](https://www.servicenow.com/docs/wSiDwUekIIs5niiGg61uuA)**   
  The Active option in an authority document indicates whether the authority documents have been retired.

*[\>]: and then