How to use ServiceNow Control Attestations to Streamline Compliance Management

The control attestation feature in the ServiceNow Policy & Compliance module can save your Integrated Risk Management (IRM) team time and create an accurate picture of compliance across your organization.

ServiceNow® control attestations help by:

• Reducing questions and back forth via emails by bringing the entire control attestation process into the Now Platform

• Reducing work burden on both control owners and compliance analyst with trackable and assigned attestation assessments

• Enabling better visibility into control compliance. The system automatically sets the compliance state of controls and keeps a record of the evidence provided by control owners

• Saving control owners time by certifying compliance of multiple controls with attestation groups

Do you want to learn more about control attestation in ServiceNow? Watch this video provided by Cerna Solutions to learn how.

| Related: Centralize Policy Management on ServiceNow IRM

Need help managing compliance in your organization?

No matter where you are on your maturity journey, Cerna Solutions has you covered when it comes to governance, risk, and compliance on the Now Platform. Recognized as a ServiceNow "Elite" partner, we are a team of 100% US-based ServiceNow professionals who specialize in ServiceNow Integrated Risk Management. Our approach to IRM has earned us a repeat customer rate of 90%, and a customer satisfaction score of 4.8/5. Learn more about our Integrated Risk experience or contact us for more information.

ServiceNow Vendor Risk Management: How to do a Tiering Assessment

Is vendor risk overlooked at your organization? In a recent Bomgar survey, 74% of people surveyed believe that third-party vendor selection overlooks potential key risks. Understanding the risks a vendor can introduce to your organization is critical to conducting a vendor risk program. By performing a tiering assessment of the vendor, organizations can better understand the type of data a vendor will be accessing and how that will impact the organization’s exposure.

Performing a tiering assessment of the vendor enables companies to understand the type of data a vendor will be accessing and how that impacts your company’s exposure.

Centralizing the process

While assessments can be managed in spreadsheets or external interviews, the process can be expedited and centralized in ServiceNow’s Vendor Risk Management application. This approach allows for a single source of truth that the organization can reference across all the vendors in the application. The data can then be sorted in a meaningful way, with automated visualization and reporting of key performance indicators.

| Read More: Centralize Policy Management on ServiceNow Integrated Risk Management

Tiering Lifecycle

After a vendor is created in ServiceNow, a tiering assessment is performed. Once the assessment is created and linked to the vendor being reviewed, assessors are chosen from within the organization. The assessment is then sent out and completed by the assigned staff and returned. The assessment responses can then be reviewed, and a tiering score can be assigned to the vendor once the tiering assessment is closed.

Tiering assessments can be repeated as needed, based on the requirements of the organization, and different assessments can be created if required.

How it Works

Watch the video for a visual walkthrough of the tiering assessment process, including how to:

• Create and open a vendor record

• Create and assign a Tiering Assessment

• Complete the Tiering Assessment

• Review the response

• Close the Tiering Assessment and assign a Risk Rating to the vendor

Performing an internal tiering assessment is a core capability within the ServiceNow Vendor Risk Management Application. A completed tiering assessment will result in an initial risk rating being applied to the vendor record giving an easily viewable score to be used when determining how to assess the vendor.

| Related: ServiceNow Vendor Risk Management Application Demo

Need help managing vendors in ServiceNow?

No matter where you are on your maturity journey, Cerna Solutions has you covered when it comes to assessing vendor risk on the Now Platform. Recognized as a ServiceNow "Elite" partner, we are a team of 100% US-based ServiceNow professionals who specialize in ServiceNow Integrated Risk Management. Our approach to IRM has earned us a repeat customer rate of 90%, and a customer satisfaction score of 4.8/5. Learn more about our Integrated Risk experience or contact us for more information.

Centralize Policy Management on ServiceNow Integrated Risk Management

Having employees follow company policies is one of the key components of a successful risk and compliance program. For policies to be followed, they need to be easily accessible and have a defined lifecycle for review, approval, publishing, and retirement.

ServiceNow policy management makes it easy to publish policies out to your company and ensure those policies are reviewed, approved, and kept up to date.

Policy Lifecycle

Managing policy lifecycles in ServiceNow enables you to take advantage of the whole ServiceNow Integrated Risk Management (or IRM) platform and extract meaningful data about policy compliance. Allowing users to submit policy exceptions in ServiceNow gives an easy way for your business to request exceptions and route directly to your policy and compliance team for review and approval.

Once the policy exception has been reviewed and approved, you can directly update your control compliance by having the policies linked to controls. This link enables compliance and risk data to be kept up to date in real-time and easily viewed in ServiceNow’s dashboards.

| Related: From Reactive to Managed: Understanding Integrated Risk Management

An Integrated Approach

Managing your policies in ServiceNow not only makes policies easy to view, but it also reduces the time spent working in email, spreadsheets, and word documents by centralizing and automating your policy management process.

How it works

Watch the video above for a walkthrough of the policy management process, including:

• Creating a policy and linking it to a control (as a policy analyst)

• Approving a policy (as a policy owner or approver)

• Reviewing and publishing a policy (as a policy and compliance manager or reviewer)

• Viewing a policy in the portal (as an end-user)

• Policy exceptions (as an end-user or system owner)

Need help managing policies in ServiceNow?

No matter where you are on your maturity journey, Cerna Solutions has you covered when it comes to managing policies on the Now Platform. Recognized as a ServiceNow "Elite" partner, we are a team of 100% US-based ServiceNow professionals who specialize in ServiceNow Integrated Risk Management. Our approach to IRM has earned us a repeat customer rate of 90%, and a customer satisfaction score of 4.8/5. Learn more about our Integrated Risk experience or contact us for more information.

| Learn more: Vendor Risk Management Application Demo