Grc Compliance Management Workspace

Accept, reject, or cancel an evidence request when you receive the evidence you requested. After requesting an evidence request using the Compliance Workspace, when the requester receives the evidence, the requester can accept, reject, or cancel the evidence request.

After a policy is published, create an acknowledgement campaign to define an audience, notify them to confirm that the policy is in compliance, and track their responses.

When a policy is approved, it is automatically published.

Using the Compliance Workspace, approve the evidence being provided before the requester views the evidence. When evidence is provided in response to an evidence request, the evidence may need an approval before the evidence is sent back to the requester. This ability ensures security and confidentiality of the evidence.

Enable the system property and run the on-demand job to calculate the compliance score of an entity based on its downstream entities' compliance scores and also its direct controls.

The Overview page of the control objective record gives you the overall details of its compliance status.

Control attestation feature is enhanced to display all the control related information in the assessment page. You can also group assessments for a user and combine them together. Therefore, all assessments that the user has to assess can be done together without having to assess one after the other.

Learn about the entity enhancements of the downstream inherited controls in the GRC application. For example, you can see information about the downstream inherited controls by looking at the entity record page. You can also see a summary of the downstream inherited controls by using a widget that is available on the entity overview page.

Instead of generating controls for individual entities and testing each entity separately with an individual control, you can use a common control and associate a primary entity to it.

The compliance analyst home page in the Compliance Workspace enables the compliance analyst to track compliance activities and helps compliance managers to ensure that the organization is compliant with various regulations and policies.

The compliance manager home page in the Compliance Workspace gives a complete overview of the compliance posture of the organization. The workspace helps the compliance manager to centrally manage internal standards, policies, and control processes that match the external regulatory standards.

There are two ways to calculate the compliance score of an entity. The existing method includes only the entity's direct controls, whereas the new logic considers the average of immediate downstream entities along with the average of direct controls of the entity.

Whenever an entity is associated to a common control and termed as a reliant entity, there is an impact on the compliance score of the entity on account of the common control test results.

Determining the calculation of an entity's compliance score, either by its direct controls or based on its downstream entities and direct controls, is based on the Entity hierarchy based scoring property.

The control objective workflow introduces a review and approval process for changes to control objective records, preventing unreviewed updates from immediately affecting downstream objects such as controls.

Configuring the Compliance Workspace requires setting up certain pre-requisite steps.

Customize the risk assessment methodology by creating your values for each question in risk assessment and calculate your risk rating scores.

Issues can be linked to different types of objects such as risk, entity, control, control objective, engagement, policy, authority document, and others to determine issue impact. Use the many-to-many relationship tables for each of the objects to link similar issues to an object.

Mark a control as common and associate reliant entities to it. Test the common control tied to the primary entity. The reliant entities inherit the results of the common control.

Policy and Compliance managers can use the Compliance Workspace to create templates for policy article publishing.

When you set up a policy acknowledgement request in the Compliance Workspace, you must identify an audience responsible for providing the acknowledgement.

Authority documents manage a process, and citations are created within them to manage the points of the process. For example, the process called Building Security contains a citation for Entry Control.

Controls can either be automatically generated or manually created. A control is created for each entity listed in the entity type for the control objective.

Indicator data for controls, risk, and audit evidence are measured differently depending on the GRC application.

A control objective is an objective, direction, or standard that acts as guidance for company interactions and operations. Control objectives can be categorized, classified, and related to policies using the Compliance Workspace.

Authority documents, citations, and control objectives are usually downloaded from a third-party provider. However, citations can be created manually from an authority document using the Compliance Workspace. The Active option in a citation indicates whether the citation is active or inactive.

Compliance or risk managers create indicator templates in the Compliance Workspace from which many indicators can be created.

A policy defines an internal practice that processes must follow. You can define policies using the Compliance Workspace as policies, procedures, standards, plans, checklists, frameworks, and templates.

The Active option in an authority document indicates whether the authority documents have been retired.

Using the Compliance Workspace, you can deactivate control objectives that are no longer relevant to their citation or parent control objective.

Starting with Version 13.0.0, a new workspace has been introduced for the GRC: Policy and Compliance Management application. The new workspace provides you with an improved User Experience (UX) and a simplified user journey.

Compliance Workspace is a unified interface where you can manage all your tasks related to policies, control objectives, controls, and policy exceptions.

Provide response to similar assessments by grouping the assessments based on metric type, and additionally the same entity, control objective, or category in the Tasks page of the Compliance Workspace.

When you are creating an issue using the Compliance Workspace, you have the option of grouping the issue with other similar issues as part of an existing parent issue group.

When you are creating an issue using the Compliance Workspace, you have the option of grouping the issue with other similar issues.

The Compliance Workspace provides an exclusive home page for the IT compliance manager to view the IT-related risk and compliance data. The workspace helps the IT compliance manager to centrally manage internal standards, policies, and control processes that are exclusively IT-related to comply with the external regulatory standards.

Continuous monitoring involves activities related to identifying and creating key risk and controls indicators. The Compliance Overview is available to compliance administrators and compliance managers, providing an executive view into compliance requirements, overall compliance, and compliance breakdowns.

You can use the Compliance Workspace to manage information related to policy approvals, policies, and control objectives.

Controls are specific implementations of a control objective. Retired controls do not appear in the list. Before defining controls, take time to rationalize, consolidate, and define the important controls in your organization.

Evidence request is used by audit and compliance teams for requesting supporting documents during an audit. Auditors and compliance teams require these documents from the first line of defense.

Using the Compliance Workspace, you can measure the effectiveness of your company's risk management program by how quickly and completely it identifies and reacts to risk and compliance issues.

Policy exceptions and extensions provide temporary relief for non-compliant controls. The policy exception captures the rationale, comments, and evidence to support the acceptance or rejection of a policy exception request.

Using the Compliance Workspace, GRC you can manually create issues to document policy, risk, or audit observations, or to accept any GRC problems. You can also identify the source of the issue to help analyze and classify the issues.

Field descriptions to enter on the New Issue form in the Compliance Workspace.

You can link an automatically generated issue that belongs to a different control as a related issue to a control. The Originator flag helps you to differentiate those control issues that were automatically generated from the controls that were manually created.

The overview page of the policy exception gives you the overall basic details of the policy exception.

Perform CRI profile assessment based on the tiering questionnaire of an entity to determine the compliance status of the controls and know the compliance score that rolls up to the entity.

Perform CRI tiering questionnaire on an entity to determine its tier, evaluation controls associated with the tier will be created or updated. Based on the response to the CRI questionnaire from the assessor, the compliance status of each mapped control to a question is determined and the overall compliance score of the entity is calculated.

Two additional custom queues have been introduced to support parallel processing capabilities. The Indicator Data Queue processes indicators. The Supporting Data Queue handles events related to control, risk, and issue updates. It also collects the supporting data.

Take the advanced risk assessment to evaluate the risk involved with the policy exception.

The policy module helps you to create and document all policies. Policies are high-level statements that define what a business should or should not do.

Using the Compliance Workspace, you can provide evidence when you are requested. When evidence is requested, the person who must provide the evidence receives an email. The process to provide the evidence begins.

Using the Compliance Workspace, you can map a single control objective to many citations from different authority documents. This function allows you to test a control objective once while complying with many different citations.

Control objective can be associated to a policy individually when the policy is in the review or draft state. Using the Compliance Workspace, you can choose the policy in the document field on the control objective, or edit the Control Objective related list.

After an issue has been identified, triaged, and investigated using the Compliance Workspace, you can remediate it.

Request evidence at any stage during an audit using the Compliance Workspace. The details about the items for which evidence is requested are also provided to the person responsible for providing the evidence.

Use the Compliance Workspace to request exceptions for policies, control objectives, or issues by specifying the reason of exception on a particular list of the systems, applications, networks, or entities for which the exception applies. You must also specify the duration for which the exception is required.

After you have been identified as a member of an audience to provide a policy acknowledgement, you must open and review the record in the Compliance Workspace, and then acknowledge it.

Retiring a policy is part of the policy management process. It can be retired using the Compliance Workspace anytime after being approved and published to the KB.

After reviewing a policy exception request using the Compliance Workspace, a compliance manager can accept or reject the request. However, if the compliance manager doesn't have enough information to decide, they can request a risk assessment by the risk manager.

The Evidence Request feature includes a related list called Related Evidence that is not visible by default.

A policy campaign is the record used to prepare for a policy acknowledgement request. It defines the audience who must provide an acknowledgement that a particular policy is in compliance. A policy campaign is requested in the Compliance Workspace only if the compliance user decides it is needed.

There are three distinct steps that must be followed to segregate, associate, and display the IT-related data for the IT compliance manager to view in the IT Compliance Home page.

Provide response to similar assessments by grouping the assessments for a user in the Tasks page of the Compliance Workspace.

Respond to your attestations by logging in to the Employee Center.

Respond to your attestations by logging in to the Risk Portal.

Respond to your attestations by logging in to the Tasks page of the Compliance Workspace.

You can select the option to attest controls using an assessment method. This assessment is an alternative method to the classic assessment that is based on ServiceNow AI Platform method of assessment.

The Lists pane of the Compliance Workspace is updated with assessments link to navigate to the assessments. The attestation and classic attestation widgets are displayed in the home pages of the compliance manager, compliance analyst, and the IT compliance manager.

After you have created an acknowledgement campaign using the Compliance Workspace, you can submit the acknowledgement request to the defined audience.

Configure dynamic approval rules to define who must approve a control objective before it can be published.

Create a control objective and move it through the workflow states from Draft to Published.

Revise a published control objective by creating a staging record, drafting changes, and publishing them after approval.

Enable the control objective workflow property to activate the review and approval process for changes to control objective records.

After an issue has been identified and submitted by employees or business users via the Service Portal, the issue triage process begins. The actual problem is identified and assigned to the appropriate owner for prioritization and resolution in the Compliance Workspace.

The Compliance Workspace has a unified tasks page. Based on the user role you can fulfil all your tasks and your team's tasks in the page.