Global Retailer Maximises ServiceNow GRC Investment

150

critical vendors assessed for Third-Party Risk

50

critical Business Apps with tracked key Controls

20

Current compliance processes were manual, ad-hoc, and reactive. Thus, responses to requests and requirements for specific audits were generated and submitted as received. 

Risk scoring was subjective based on various inputs and a manual assessment, and the risk register was manually maintained in Excel.

The hierarchy between vendors and respective engagements was not configured, which made it difficult to assess, manage, and monitor vendor risk exposure effectively. 

Policy and Compliance Management 
Delivered compliance functionality, including a working entity model, initial set of control objectives/controls, associated organisational policies, and initial frameworks/authorities.

Risk Management

Introduced Risk management functionality, including defined entities for applying risk against, an initial set of risk statements/risks with related risk frameworks, and a risk assessment process

Third-Party Risk Management

Leveraged ServiceNow's Third-Party Risk Management capabilities, including engagement roll-up to vendors, internal tiering assessments, external risk assessments, issues/remediations, and tiebacks to compliance controls.