Audit Management

Accept, reject or cancel an evidence request when you receive the evidence you requested. After requesting an evidence request, when the requester receives the evidence, the requester can accept, reject, or cancel the evidence request.

Link a cloud file on Microsoft using file path and file name with a GRC ​record in the Workspace.

Add a new or existing document to an engagement, control test, or evidence record from the Documents panel.

Assign audit tasks to auditors in an engagement from the resource plans. Resource plans track the cost associated to auditors. Considering this cost is important while planning the engagement.

Add entities related to the selected auditable units to the engagement. In addition, you can also add entities other than the ones created for auditable units to the engagement.

Audit managers can define which entities are involved in the audit engagement. When you add an entity to an engagement, the corresponding risks, controls, test plans, and indicator results of the entity are also added to the engagement.

If you are an audit user and are assigned as an approver for an engagement, you can approve or reject an engagement in the Awaiting Approval state.

Approve the evidence being provided before the requester views the evidence. When evidence is provided in response to an evidence request, the evidence may need an approval before the evidence is sent back to the requester. This ability ensures security and confidentiality of the evidence.

Review or approve a document version from your task list.

Approve a plan if you're assigned as an approver after plan creation. You can also request that the plan be reviewed or request more information about the plan from the plan creator.

Audit users that are assigned as approvers for an engagement can approve or reject engagements in the Awaiting Approval state.

Any audit project has associated costs, budgets, and resources. Roll ups of these costs, budgets, and resources enable the audit manager to view the entire costs and resources in a consolidated manner.

The audit entry field marks a record as third-line, restricting its visibility to users who hold the third-line manager role. Third-line records are excluded from the views and calculations that second-line users rely on.

You can run the GRC Audit Management application by downloading it from the ServiceNow Store and then configuring the settings in the setup checklist to meet your needs. Mandatory and optional setup steps, as well as an implementation checklist, are provided to simplify the setup.

If any conkeyrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file.In the short description, edit the first sentence to state whether domain separation is supported or not and add the application name. Keep the conkeyref at the end that describes domain separation.Domain separation is supported for Audit Management. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Audit workspace provides a single-pane view for audit supervisors and auditors. View the overall audit timeline and status, track budget and resources for engagements, trace high priority observations and issues, and monitor ongoing control testing and audit task progress.

The following sections show the roles and access limitations to the tables used in Audit Management.

The Audit Management automates the work streams of internal audit teams, optimizing resources and productivity, and eliminating recurring audit findings. Audit Management uses compliance and risk data to scope, plan, and prioritize audit engagements. The on-going review of policies and procedures, risks, and control breakdowns provide an opportunity for fixing issues before they become audit failures.

The Audit Manager dashboard provides the current view of audit engagements and related audit activities. Users with the sn_audit.manager role can view this dashboard. This Audit Manager dashboard is part of the Advanced GRC dashboard.

Audit observations are the results of an audit. As an important part of the audit report, audit observations represent the results of reviews, analysis, interviews, and discussions.

An audit supervisor organizes and manages internal audits according to plans.

Audit tasks are completed throughout an engagement and provide documented evidence that the organization is complying with external regulations and internal policies.

The table gives a description of the field values for the Word template category form. Template categories enable you to categorize similar reports and filter them accordingly. For example, Audit or CAM is a category.

The table gives a description of the field values for the Word template form.

The auditor workspace is a centralized workspace for managing audit activities.

After adding an entity to an engagement, you can automatically generate control tests.

The Engagement Overview provides an executive view into audit results and engagement breakdowns by task to quickly identify areas of concern.

The Engagement Workbench provides a timeline view from which you can select an audit engagement to view details or create an engagement.

Audit tasks are completed throughout an engagement and provide documented evidence that the organization is complying with external regulations and internal policies.

An audit engagement may include control testing activities during which controls are evaluated for design and operational effectiveness.

The audit engagement process involves creating, planning, scoping, and conducting engagements as well as reporting on engagement findings.

The ServiceNow Audit Management application involves a set of activities related to planning audit engagements, executing engagements, and reporting findings to the audit committee and executive board. Engagement reporting assures key stakeholders that the organization's risk and compliance management strategy is effective.

You can set the confidentiality flag at the record level for an issue, engagement, observation, control test, activity, interview, and walkthrough records. The users whom you determine to view and update these records are allowed users.

Generate your audit reports for an engagement in Microsoft Word template to collaborate with your auditors in an effortless and user-friendly manner.

Link an existing document from a supported external cloud storage provider into the Documents panel.

Use the Connect external cloud action in the Documents panel to link an existing document from a supported external cloud storage provider without downloading and reuploading the file.

Continuous monitoring involves activities related to identifying and creating key risk and control indicators. Supporting information can be collected for those indicators through automatic data collection or manual tasks. Indicator results are then used to create issues for controls, update risk scores, and provide supporting information for audit activities and control testing.

Organize documents by creating folders and nested folders in the Documents panel.

Create a File access permission record and manage the access permissions on the cloud document.

Create an activity that explores and provides documented evidence of whether the associated control is operating correctly or not.

Create audit entry records to track third-line audit objects in the Audit Workspace. Audit entry records are read-only after the first save and are hidden from second-line users.

Create a plan to manage different types of audits in a periodic manner and group engagements in a logical manner.

Create an audit plan to manage different types of audits in a periodic manner and group engagements in a logical manner.

Create an audit report template to generate an audit report. If you're an audit developer, you can use either the HTML, Script, or XML format to create an audit report template. You can then use the audit report template to display data in an audit report.

Create auditable units with entities such as business units, departments, vendors, products, business processes, and business applications. Perform risk assessments on the auditable units.

Create auditable units to identify business entities that can possibly be at risk and scope them into audits.

Create a control test that runs periodically and provides documented evidence of whether the associated control is operating correctly or not.

Audit managers can create engagements from previous engagements to reduce the need to redefine the scope, auditors, and approvers for similar engagements that are conducted throughout the year.

The Engagement Workbench provides a timeline view from which you can select an audit engagement to view details or create a new engagement. Audit managers create engagements directly from the Workbench to manage audit information and collect entities, controls, and control tests that are relevant to the audit.

Create an engagement in the workspace and assign it to an audit supervisor. Use the workspace to schedule the engagement, plan the details, and budget the expenses.

Create an interview with control owners to discuss and provide documented evidence of whether the associated control is operating correctly or not.

Create an issue to document policy, risk, or audit observations, or to accept any GRC problems. You can also identify the source of the issue to help analyze and classify the issues.

Create a milestone for an engagement to track the progress of an engagement. You can also add audit tasks to a milestone.

Create and track an audit task as a milestone.

Create milestones for an engagement to track the progress of an engagement. You can also add audit tasks to a milestone.

If GRC: Policy and Compliance Management is installed, a test template can be used to create test plans for all the controls associated with the control objective of the test plan.

Create an observation for an audit task to comply with federal state and local security legal requirements by studying the existing and new security legislation.

Create an audit observation to present a summary of problems, discoveries, and recommendations. The audit team can then review the observations to determine if the observation is a reportable issue.

Create a test plan to document the control testing procedure. You can create a test plan from scratch or based on a test template to describe how a feature is to be tested.

Create a test step plan from the Audit Workspace by selecting a test plan, opening the Test step plans tab, and entering details like identifier and assessment objective.

Create and add a test step template to a test template from the Audit Workspace to define control assessment steps.

Create a test template and use it to create test plans applying much of the same testing criteria.

Apply the objective effectiveness of the test step and the operating effectiveness, desired effectiveness of the control test to determine the control effectiveness of the control test. A test step is applied to check the control test at a granular level.

Create and conduct a walk through to observe and provide documented evidence of whether the associated control is operating correctly or not.

Use the advanced planning capabilities to create an engagement that automatically creates an engagement project. After an engagement project is created, you can add resource plans and cost plans to the engagement. The values of these plans roll up to the engagement and to the audit plan.

Update the access permissions for a record in the Cloud file configuration record form.

The GRC Workspace administrators can create a Cloud file configuration on engagements and audit tasks from the Cloud file configuration module.

A new version of a document in the Documents panel goes through an optional review and approval workflow before publication.

Actions available on a document in the Documents panel include Download, Rename, Remove, Edit metadata, Track versions, Manage permissions, Connect external cloud, and Publish.

Use the Duplicate as audit entry action to copy a second-line control, control objective, risk, or risk statement into a new third-line record. Each source record can be duplicated only once.

Edit document properties such as owner, type, classification, and access settings from the Documents panel.

Complete the prerequisites to manage your documents using Microsoft so that you can enable the cloud file integration.

The advanced planning capability enables integration of Advanced Audit with the Project Portfolio Management (PPM) product. The capability creates an equivalent project for the engagement and provides planning features for resource planning, cost planning, and more.

Evidence request helps users to electronically request the information that they need from the first and second line of defense. The individuals being audited can then immediately upload their documents to the system, significantly reducing manual processing time.

Evidence request is used by audit and compliance teams for requesting supporting documents during an audit. Auditors and compliance teams require these documents from the first line of defense.

Update the File access permission record form for a Cloud file.

The Workspace administrators with the sn_grc_workspace.admin role can configure the file access permissions for the users and groups.

Use the voice agent to generate an audio summary of a supported document or ask questions about its content.

Generate an audit report and maintain different versions of audit reports from an engagement in Follow up state.

Generate an audit report for an engagement record using Microsoft Word template that is in the Validate state or any subsequent states. You can manage the generated report either on cloud (Microsoft SharePoint) in the Cloud files tab or as a sys_attachment to the engagement.

Audit managers can generate a KB article that summarizes the findings of an engagement so report findings can be communicated to executives.

Generate a report that summarizes the findings of an engagement to communicate the report findings to executives.

Find the Microsoft SharePoint site ID or drive ID to enter in the File location ID field of a Cloud file configuration record.

Platform Analytics contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

The Audit Engagement Overview dashboard provides an executive view into audit results and engagement breakdowns by task, allowing areas of concern to be identified quickly.

Use the Issue form to create a new issue.

Issues can be created manually to document audit observations or remediations, or to accept any problems. They are automatically generated from indicator results, attestation results, or control test effectiveness.

Link a reference cloud file that is already associated to other GRC records.​ You can link shareable files​ only.

The Lite Audit workspace is a simplified version of the Audit Management workspace. In this workspace, you can access engagements, add existing entities to an engagement, and create activities. If the advanced core store app is installed, evidence(s) can also be associated with the engagement.

Create a cloud file configuration record to manage the access permissions on the cloud document.

You can manage your documents and work papers with Audit Management as cloud files using cloud providers like Microsoft instead of attaching them to the record.

Use the Manage permissions action on a document in the Documents panel to control who can read or write to the document.

The Document Management System in Audit Workspace provides a centralized repository for storing and managing documents in engagements, control tests, and evidence records. The Documents panel is a native side pane that allows you to store, version, and control access to documents.

Select one of the already linked files and mark it as a non-sharable file. Once a cloud file is marked as non-sharable, it cannot be linked to another record, or it cannot be referenced by any other record​.

Select one of the non-sharable files and mark it as sharable. Once the cloud file is marked as shareable, it can be linked to another record, or it can be referenced by other records.​

The table gives a description of the field values for the Matrix report configuration form.

The table gives a description of the field values for the Matrix column configuration form.

The table gives a description of the field values for the Matrix relationship form.

Matrix report is a structured report that you can configure to view in a grid or table format in the Audit Workspace. You can use the matrix report to analyze relationships between different objects, for example assessing risks and controls.

Configure the Matrix report registry to select the base table. You can create a relationship with the target table to configure the details of the report for an audit-related record or a landing page.

Create the matrix report configuration by naming the report, selecting its display type, and setting filter conditions on the base table.

Configure the fields in the target table as column heads in the matrix report, which is the second level of configuration for the audit matrix report.

View the Matrix report in the Audit Workspace that presents the data in a structured format.

Milestones can be used to track the progress of an engagement.

Audit observations are the results of an audit. As an important part of the audit report, audit observations represent the results of reviews, analysis, interviews, and discussions.

After you create and save an engagement with the basic information such as the description, dates, scope, and the objectives, you can see the overview page.

Provide evidence when you are requested. When evidence is requested, the person who must provide the evidence receives an email. The process to provide the evidence begins.

Publish an approved document version to set it as the current version.

Validate that GRC: Audit Management still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Activating the GRC: Audit Management (com.sn_audit) plugin adds or modifies several tables, user roles, and other components.

Remove a document from an engagement, control test, or evidence record in the Documents panel.

Remove a linked cloud file from a record in the Audit Workspace.

Request evidence at any stage during an audit using the Audit Workspace. The details about the items for which evidence is requested are also provided to the person responsible for providing the evidence.

Request evidence at any stage during an audit using the Audit Workspace. The details about the items for which evidence is requested are also provided to the person responsible for providing the evidence.

Request evidence at any stage during an audit. The details about the items for which evidence is requested are also provided to the person responsible for providing the evidence.

The advanced planning capability enables integration of Advanced Audit with the Project Portfolio Management (PPM) product. The capability creates an equivalent project for the engagement, and provides planning features that could be used for resource planning, cost planning, and so on, from the engagement.

Grant role-based or user-based read and write permissions on a document in the Documents panel.

Configure a reviewer and one or more approvers on a document version before submitting it, so the version is reviewed and approved before it publishes.

Complete the checklist that includes the setup tasks required to complete in your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation.

This checklist includes the setup tasks that you are required to complete in your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation. Optional setup procedures are also included to enhance Audit Management functionality.

For supported document types, you can use AI to summarize a document, ask questions about its content, and generate a voice summary, without opening the document.

Use the ServiceNow Otto panel to summarize a supported document or ask questions about its content.

Before you run GRC: Audit Management (com.sn_audit) in your instance, you must download it from the ServiceNow Store.

After defining a control, audit managers create activities that explore and provide documented evidence of whether the associated control is operating correctly.

Create an Indicator to monitor the controls and risks and collect evidence of performance.

After defining a control, audit managers create interviews with control owners to discuss and provide documented evidence of whether the associated control is operating correctly.

As a GRC user, you can manually create issues to document policy, risk, or audit observations, or to accept any GRC problems. You can also identify the source of the issue to help analyze and classify the issues.

Test templates allow audit managers to quickly create many test plans using much of the same testing criteria.

After defining a control, audit managers create walkthroughs that will be conducted to observe and provide documented evidence of whether the associated control is operating correctly.

After defining a control, audit managers create control tests that run periodically and provide documented evidence of whether the associated control is operating correctly. After creating multiple control tests on an engagement, use the Control tests grid to view, manage, and request evidence for all tests in one place.

Audit managers create engagements to manage audit information and collect entities, controls, and control tests that are relevant to the audit.

Compliance or risk managers create indicator templates from which many indicators can be created.

Test plans can be created from scratch or based on test templates and describe how a feature is to be tested.

Audit owners can create generic control test templates for a control objective, avoiding the creation of individual control test plans for every control.

Audit users and audit managers can now use the Time Card Management feature to log and capture hours for engagements and other tasks on an engagement.

There are many types of audits and each of the audit types has a specific use in an audit engagement.

Update the audit tasks such as walkthroughs and interviews that are assigned to you when you get a notification.

Use the Audit Workspace to ensure compliance with the established internal control procedures by reviewing records, reports, operating practices, and documentation.

Upload a new version of a document when you need to change its content. You can optionally send the new version for review and approval before it publishes.

Upload local documents from your local drive to Microsoft cloud and manage the access to the cloud files.

The scope of audit management includes automation of the work streams of internal audit teams, optimizing resources and productivity, and eliminating recurring audit findings.

Use the Control tests tab on an engagement record to view, manage, and request evidence for all control tests in a single grid.

An audit plan enables you to plan all your audit engagements in a systematic and logical manner.