IRM for Beginners: How ServiceNow Connects Risk, Compliance, and Business Decisions

What is IRM?

IRM (Integrated Risk Management) helps organizations manage risk, controls, policy obligations, and compliance activities in a connected model.

Instead of siloed spreadsheets, IRM centralizes risk decisions and evidence.

Simple IRM Building Blocks

GRC Tables in the Platform

IRM/GRC ships as scoped applications with their own tables. Two you will meet immediately:

Table	What it stores
sn_compliance_control	Controls — the preventive/detective mechanisms, with owners and attestation state
sn_grc_profile	Entities — the things risks and controls apply to (systems, processes, departments)

Policies, risks, issues, and indicators live in further tables within the Policy and Compliance and Risk Management scopes — explore them from the application navigator on a PDI rather than memorizing names.

// Quick look: how many active controls exist? (run in Background Scripts)
var ga = new GlideAggregate('sn_compliance_control');
ga.addQuery('active', true);
ga.addAggregate('COUNT');
ga.query();
if (ga.next()) {
    gs.info('Active controls: ' + ga.getAggregate('COUNT'));
}

• Risk: what could go wrong and impact objectives.
• Control: preventive/detective mechanism.
• Policy/Requirement: governance expectations.
• Issue: control gap requiring remediation.

Why Leaders Invest in IRM

• Single view of enterprise risk posture
• Clear control ownership
• Faster audit readiness
• Fewer manual evidence chases

Beginner Rollout Sequence

1. Define top enterprise risks and taxonomy.
2. Map key controls with owners.
3. Attach obligations and testing schedules.
4. Track issues and remediation lifecycle.