ServiceNow Risk Management Managing IT and business risk across the enterprise With the increasingly complex business environment and threat landscape, it has become essential to identify, assess and manage risks more holistically. Risk is inherent as organizations deal with products, services, processes, systems, technologies, vendors, people and more. Risks arising from any of these can cause business disruption, impacting strategic objectives and resulting in financial losses and reputational damage. ServiceNow Risk Management helps identify risks across organizational siloes through continuous monitoring and the Advanced Risk Assessment engine. The engine is built to address risk through an integrated risk framework. The framework provides the ability to quickly identify, prioritize, and react to a wide variety of risks emerging throughout the organization with a single lens and common language. This unique approach enables you to do business with confidence knowing the risks and opportunities. Respond to risks in real-time with ServiceNow ServiceNow Risk Management helps you detect and assess the likelihood as well as business impact of an event based on data aggregated across your extended enterprise; and respond to critical changes in risk posture. Risk Management works closely with Policy and Compliance, Audit, Vendor Risk, Business Continuity Management, and Continuous Authorization and Monitoring. • Policy and Compliance Management - Automate best practice lifecycles, unify compliance processes, and provide assurances around their effectiveness. • Audit Management – Scope and prioritize audit engagements using risk data and entity information to eliminate recurring audit findings, enhance audit assurance, and optimize resources around internal audits. Identify risks in real-time Configure real-time business and IT service performance data and identify vendor requirements to enable automated controls testing. Define thresholds as indicators for continuous monitoring of your extended enterprise Increase performance Risk management embedded in automated cross-functional activities eliminates work interruptions Unparalleled user experience An intuitive risk management workspace is tailored to your unique needs, with navigation streamlined for just what a Risk Manager cares about. Effectively communicate risk Real-time insights and role- based dashboards make reporting at all levels easier and faster. Improve strategic planning and decision making Fine-grained business impact analysis, task management, and contextual alignment with the CMDB on a single platform provides cross-functional visibility to identify, prioritize, and appropriately respond to risks Stay on top of risks Mobile interfaces provide the information you need to do your job anytime and anywhere. Extend your ServiceNow investment The single platform of engagement offers orchestration, easy integration, data ingest and publication Risk Management homepage highlights enterprise risks • Vendor Risk Management – Consolidate risks associated with third parties alongside enterprise risks for a holistic view across the extended enterprise. • Business Continuity Management and Operational Resilience – Identify and track the risks associated with business disruptions and disasters as a key part of a robust integrated risk management program. • Continuous Authorization and Monitoring – Automate the processes that support risk management frameworks including NIST RMF used to achieve certifications such as CMMC, bring systems on-line faster, and enable continuous authorization. The importance of risk management Compressing the time to identify, prioritize, and respond to changes in your risk and compliance posture is imperative. To do so you need to continuously monitor data across your extended enterprise to speed detection of emerging risks. Automating the appropriate remediation and risk treatment actions across business and IT processes breaks down the silos and ensures a rapid response. The Now platform collaboration engine and issues management capabilities work across risk and compliance applications, and with the Vendor Portal to create a shared understanding and facilitate timely decisions. Create a risk register Establish a standard taxonomy across the business, risk, compliance, and audit with a risk register or risk catalogue that can be broken down to a granular level. This provides the flexibility to drill down as you navigate your maturity journey. It also drives clear ownership. Having an inventory of all risks and controls in a centralized repository or risk universe makes it easier to aggregate risks at various levels of the hierarchy, providing visibility into the areas that need focus. ServiceNow is uniquely positioned to connect the risks and controls to lines of business, functions, assets, processes, business services and many other components in the Configuration Management Database (CMDB) - providing business context. ServiceNow Risk Management enables you to create and map risks and controls to the flexible enterprise hierarchy, reflecting today’s matrixed organization. Automated risk assessments Evaluate inherent risk, the effectiveness of the control environment, and residual risk through manual or automated risk assessments. The built-in Advanced Risk Assessment engine is flexible enough to support multiple risk frameworks simultaneously, irrespective of whether it is top-down or bottom-up, quantitative or qualitative, simple or complex in nature. ServiceNow Risk Management powers real-time risk assessments using automated factors that can fetch information on any data point in the Now Platform®. Automation will enable you to be agile in responding instead of muddling through with stale data. Implement real-time monitoring ServiceNow Risk Management identifies non-compliant controls, monitors high-risk areas, and manages the Key Risk Indicator (KRI) and Key Control Indicator (KPI) library with automated data validation and evidence gathering. Because data from applications across the enterprise is consolidated in the Now Platform you can gather any information and move from a point in time methodology to continuously monitoring risk for any department or function. Provide visibility at all levels Interactive real-time dashboards provide overviews of your risk and compliance posture. The ability to provide decision-makers, at all levels of the business, with up-to-date information regarding the organization's risk posture is critical in a risk management program. You will have all the information necessary to make informed decisions to manage risk effectively. The platform also enables users to easily create their own reports. Learn more at: https://www.servicenow.com/prod ucts/risk-management.html © 2022 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective companies with which they are associated. SN_DataSheet_Risk-Management_MAY_2022 servicenow.com The Risk Management workspace for Operational Risk Managers