Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIS - ServiceNow > CIS - IRM Fundamentals > Flashcards

CIS - IRM Fundamentals Flashcards

1
Q

Integrated risk management

A

is a set of practices, supported by a risk-aware culture and enabling technologies, that improve decision making and performance through an integrated view of how well an organization manages its unique set of risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

2 workspaces for IRM

A

Compliance Workspace
Risk Workspace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

360 degree view

A

displaying upstream, downstream, and related records are available for many types of records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

sn_audit.manager

A

a manager of the internal audit team and is responsible for creating audit engagements and monitoring the status of audit tasks and issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

citation

A

a breakdown of the authority document.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

control objective

A

the breakdown of a policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Controls

A

test plans are related to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Entities

A

people, places, or objects that need to be monitored in order to manage risks, track control compliance, and reviewed as part of audit engagements.

i.e. organization’s assets, vendors, business services, and business units.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Entity types

A

dynamic categories containing one or more entities.

They are associated to policies, control objectives, risk frameworks, and risk statements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Entity classes

A

Top-level organizational structure used to tag entities across different entity types.

An entity can belong to many entity types, but it can have only one entity class.

One entity type can have entities that belong to different entity classes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Entity tiers

A

a way for an organization to logically group entity classes and then filter reports by those groupings. They are used for building entity hierarchy between various entity classes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

entity scoping

A

when an organization defines what people, places, or objects, such as processes, vendors, and departments, should be monitored for compliance and included in risk management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

benefits of entities

A
  1. Scalable - leverages other ServiceNow data
  2. Repeatable - dynamically creates new entities that inherit controls and risks
  3. visibility - provides visibility on multiple levels of the organization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Commonly leveraged tables often begin with

A
  1. cmn - for common tables
  2. sys - for system tables
  3. cmdb_ci - for cmdb tables
  4. core - for core tables
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When entities are created and associated individually, a control is only created for that entity.

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

risks can be automatically generate for all entities associated with the entity type

A

when entity type is created, populated and associated with risk statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Cascading updates

A

if an entity is deactivated, all associated controls, risks, indicators, and test plans are retired. If the entity ever gets reactivated again, the associated controls and risks revert to the Draft state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

corporate compliance

A

means having internal policies and procedures in place to prevent and detect violations of applicable laws, regulations, and ethical standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

regulations

A

a law or rule governing the behavior and practices of an industry or market that is set and maintained by a constituted authority or regulatory body.

are issued by regulatory bodies for many diverse reasons, such as to regulate the way business is conducted to ensure ethical practices and fair competition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

General Data Protection Regulation (GDPR)

A

Regulation protecting the data of individuals residing in the European Union (E.U.) and the European Economic Area, regardless of where the data is stored or processed.

Applicable to any company storing or processing data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Sarbanes-Oxley (SOX) Act of 2002

A

Law passed by U.S. Congress to help protect investors from fraudulent financial reporting by corporations.

Applicable to all publicly traded companies in the United States and wholly owned subsidiaries and foreign companies that are publicly traded and do business in the United States.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Health Insurance Portability and Accountability of 1996 (HIPAA)

A

Federal U.S. law requiring the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.

Applicable to healthcare providers if they transmit health information electronically in connection with covered transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

standard

A

benchmark circulated by a regulatory agency and created to enforce the provisions of legislation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

standards example

A
  1. Payment card industry data security standard
  2. National Institute of standards and technology 800-53
  3. ISO/IEC 27001
  4. Criminal Justice Information Services (CJIS) compliance standard
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

framework

A

a group of underlying and interrelated procedures, policies, regulations, guidelines, codes of conduct, and other regulatory documents sourced from legislation and meant to codify and clarify the intent of a law/act/regulation.

Broad overview or outline of interlinked items that supports a particulate approach to meet a specific objective and serves as a guide to be modified as required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

examples of framework

A
  1. FedRAMP (Federal Risk and Authorization Management Program)
  2. Center of Internet Security (CIS)
  3. Control Objectives for information and related technology (COBIT)
  4. HITRUST Common Security Framework
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Compliance Admin (sn_compliance.admin)

A

Set up the policy and compliance application
Coordinate and facilitate configuration requests
Delete authority documents, citations, policies, policy statements, and controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Compliance Manager (sn_compliance.manager)

A

Manage the compliance library
Relate control objectives to citations and policies
Create and manage entity types and entity filters
Leverage entity types and entities for scoping
Approve and retire policies and track policy exceptions
Manage policy acknowledgement campaigns and related audiences
Triage, monitor, and review compliance issues
Monitor control testing and control performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Compliance User (sn_compliance.user)

A

Create policies and manage the policy lifecycle
Relate policies to control objectives
Send out policy acknowledgement campaigns and monitor progress
Schedule and follow-up with attestations for control validation
Respond to an indicator task
Create, manage, and review issues
Request evidence for controls, policies, and issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

GRC business user (sn_grc.business_user)

A

Leveraged across GRC applications. This role is targeted at users that support the GRC process.

Respond to issues and evidence requests
Perform indicator tasks
Perform remediation tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Control Owner (sn_compliance.user)

A

Respond to control tests and evidence requests on the controls they own
Respond to indicator tasks assigned by the compliance team
Create and manage control issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Corporate compliance analyst (sn_compliance_ws.corporate_compliance_analyst)

A

tracks compliance activities and helps compliance managers to ensure that the organization is compliant with various regulations and policies.

Analyze and update the existing policies and related documents.
Implement policies and controls when assigned.
Monitor the performance of controls.
Schedule and follow up attestations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Corporate compliance manager (sn_compliance_ws.corporate_compliance_manager)

A

manages internal standards, policies, and control processes that match the external regulatory standards.

Ensure that all policies and regulations are being followed.
Create and maintain policies up to the level of defining and applying controls.
Approve and track policy exceptions and issues.
Manage the team appropriately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

IT compliance manager (sn_compliance_ws.it_compliance_manager)

A

IT compliance manager manages internal standards, policies, and control processes that are exclusively IT-related to comply with the external regulatory standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Authority documents

A

compile the regulatory content that business processes follow for compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Citation

A

defines a section of an authority document to which an organization must comply.

A citation maps to one authority document

Citations can be part of hierarchical, parent-child relationships

Citations can be mapped to one or many control objectives.

Citations are mapped to control objectives so that compliance is measured as a control is tested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Policy

A

defines an internal practice that an organization or business process must follow to ensure compliance and reduce risk exposure.

can be categorized and related to control objectives.

policy defines an internal practice that an organization or business process must follow to ensure compliance and reduce risk exposure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Control objective

A

is an objective, direction, or standard that acts as guidance for company interactions and operations. Many times, based on citations

frequently referred to as internal compliance requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

control

A

is the implementation of a control objective for a scoped entity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Compliance score percentage

A

80 or higher in green

80 to 50 in yellow

Below 50 in red

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

things about Policies

A
  1. can be created manually or imported using a ServiceNow transform map.
  2. can be arranged in parent-child hierarchical relationships with other policies and with control objectives.
  3. can be sorted into manageable, reportable groups through type and category fields.
  4. can be related to multiple control objectives.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Procedure

A

Fixed, step-by-step sequence of activities or course of action that must be followed to correctly perform a task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Standard

A

Documentation of requirements, specifications, guidelines, or characteristics that can be used consistently to ensure that materials, products, processes, and services are fit for their purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Plan

A

Written account of an intended future course of action aimed to achieve specific goal(s) or objective(s) within a specific timeframe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Checklist

A

List of items required to be done to perform a specific task or set of tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Template

A

Design, mold, or pattern of an item or group of items that serves as a basis or guide for designing or constructing similar items

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Policy record lifecycle

A
  1. Draft - default state upon creation
  2. Review
  3. Awaiting approval - all approvers must approve. if there’s no approvers, policy automatically gets published
  4. Published - a KB article gets published
  5. Retired - the KB article also gets retired
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

who can create policies

A

compliance users and above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

who can move policies into review state

A

compliance users and above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

who can move a policy from Review to the next state?

A

any of the named Reviewers or the Policy Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

when do approvers receive notification?

A

after policy goes to Awaiting Approval state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

who can manually retire a policy?

A

compliance manager or policy owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Policy acknowledgement campaigns

A

allow customers to define a policy and present that policy for review and acknowledgement by employees in a company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Controls are automatically generated when

A

an entity type is associated with a control objective and the “Creates controls automatically” checkbox is checked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Controls can also be manually created when

A

associated with an entity from the All Controls module or from the Controls related list on a control objective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

When Inherit from control objective option is enabled

A

the control automatically inherits the name and description of the control objective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

A control is considered implemented if we have a way to measure it.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Control attestations

A

surveys that gather evidence to prove that a control is implemented. The attestation provides documentation that the control owner has a defined method to measure the control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Indicators

A

Indicators are used to measure if a control is effective or not and are powerful data collectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Control tests

A

can be part of an audit or compliance process used to validate if the control method is effectively designed and is operationally effective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

answers the question, “Has the control been implemented?”

A

Control attestations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

answers the question, “Is the control effective?”

A

Indicators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

answers the question, “Is the control effective from a design and operation standpoint?”

A

Control tests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

control record lifecycle

A

Draft (default state upon creation) > Attest > Review > Monitor > Retire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

all compliance users can modify the control in Draft state

A

Draft stage of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

control owners are assigned the control by default

only assigned to user can complete

A

Attest stage of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

controls are automatically moved to review after attestation is completed

Compliance manager can review

A

Review stage of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

in this stage, controls cannot be edited,

indicators are scheduled and updates are made by indicators

A

monitor stage of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Compliance manager can manually retire control

when control is no longer relevant

automatically set to this stage when entity becomes inactive

A

retire stage of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Policy exception management

A

allows an organization to assess the impact that a policy exception can have on related entities, with a related workflow for approving or rejecting an exception request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

who may be involved in the policy exception workflow?

A

the control owner,
the compliance manager,
the risk manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Policy extension

A

can be requested before the policy exception expires.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

how can policy exception be created?

A
  1. policy exception module
  2. from issue record
  3. from control objective record
  4. service portal
  5. integration registry
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

policy exception record lifecycle

A

New > Pending Verification (optional) > Analyze > Review > Awaiting Approval > Approved > Closed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

who can request a policy exception?

A

snc_internal users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

who can modify a policy exception during analyze stage?

A

compliance manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

who can submit more info of policy exception during review stage?

A

requester or risk manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

who reviews the policy exception

A

compliance manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

who approves the policy exception

A

compliance manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

who closes the policy exception

A

compliance manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Issues

A

a task that allows end users to track the response to remediate or accept the issue.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

issue triage record lifecycle

A

New > Analyze > Review > Close

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

who reviews the triage issue?

A

compliance manager
risk manager
triage manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

who can close the triage issue?

A

triage manager
triage team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

remediate issue

A

This provides a choice to fix the underlying issue causing the control failure or risk exposure

86
Q

accept issue

A

This provides a choice to create an exception for a known control failure or risk. Note that this is not a policy exception
Accepting a control issue will cause the control status to remain non-compliant until the control is re-assessed

87
Q

issue record lifecycle

A

New > analyze > respond > review > closed

88
Q

who is responsible for selecting issue rating during analyze stage of the issue lifecycle?

A

Issue Manager

89
Q

who completes the response and manage in the respond state of the issue lifecycle

A

issue owners

90
Q

who reviews the issue and accepts resolution/request more info from the owner

A

issue manager

91
Q

who closes the issue

A

issue manager

92
Q

Policy Overview dashboard

A

The Policy Overview dashboard provides different views of controls associated with your policies.

It gives an overview of the total number of controls grouped by different parameters and the number of compliant controls.

93
Q

Attestation Overview dashboard

A

The Attestation Overview dashboard provides views of attestations.

Attestation respondents can see attestation status and list of pending attestations.

94
Q

Compliance Overview dashboard

A

The Compliance Overview dashboard provides views into the source of compliance requirements, the level of compliance, and trends.

95
Q

Policy Exception Overview dashboard

A

The Policy Exception Overview dashboard provides views into the number, severity, and source of policy exceptions. It shows exempted controls.

96
Q

Policy Acknowledgement dashboard

A

The Policy Acknowledgement dashboard provides views into the number and statuses of policy acknowledgements. It also shows policy exemptions.

97
Q

Regulatory change management

A

the management of regulatory, policy, and/or procedural changes that apply to an organization.

98
Q

Regulatory changes

A

sourced from regulatory intelligence providers such as Thomson Reuters Regulatory Intelligence or from public RSS feeds.

99
Q

Regulatory alerts

A

Regulatory alerts are an aggregation of different regulatory events and documents sourced from multiple regulatory intelligence providers.

100
Q

RSS feeds

A

web feeds that allow users and applications to access updates to websites in a standardized format.

These feeds allow users to track different websites in a single news aggregator.

101
Q

RCM Admin (sn_grc_reg_change.admin)

A

Set up the regulatory change management application

Coordinate and facilitate configuration requests

Maintain taxonomy values

102
Q

RCM IT Admin (sn_grc_reg_change.it_admin)

A

Set up the regulatory intelligence providers in the ServiceNow RCM application

103
Q

RCM Admin (sn_grc_reg_change.manager

A

Monitor the progress of regulatory change initiatives within the organization

View all the regulatory content updates relevant to the organization

Assign new regulatory alerts that are sourced from external sources

Assign regulatory tasks within the teams responsible for managing regulatory change.

104
Q

RCM User (sn_grc_reg_change.user)

A

Assess the applicability of regulatory alerts to the organization

Initiate impact assessments and assign them to subject matter experts (SMEs) or owners within the organization

Complete assigned regulatory tasks
Create actions tasks for the risk and compliance users to complete

105
Q

GRC business user (sn_grc.business_user)

A

Respond to impact assessments assigned to them

106
Q

Regulatory change management in the compliance workspace

A

It provides a single-pane view with a personalized experience and a simplified user journey.

The home page provides actionable insights and quick links.

The contextual side panel displays the regulatory taxonomy for each regulatory alert record.

107
Q

Activity Overview - RCM in Compliance Workspace

A

Displays alerts, change tasks, import document tasks, alerts by overall impact, impacted entities, and taxonomy alerts.

108
Q

Tracking - RCM in Compliance Workspace

A

Displays status of open and unassigned alerts, ongoing and overdue impact assessments, open and overdue issues, open and new action tasks.

109
Q

Trends - RCM in Compliance Workspace

A

Displays past trends over a period of time such as open alerts for the last 12 months..

110
Q

Task Contextual Pane - RCM in Compliance Workspace

A

Displays all the tasks assigned to individual and to their group.

111
Q

Taxonomy management application

A

helps in classifying and categorizing the alert.

can be used to manage categories for our content classification across GRC modules.

112
Q

Regulatory Bodies

A

Organizations that exercises regulatory functions,
i.e. government agency, trade associations, self-regulatory organization

113
Q

Sectors

A

different business segments for organizations,
i.e. banking, insurance, medical devices

114
Q

Themes

A

broad topics that can be used to classify regulatory content
i.e., privacy, operational resilience, regulatory filings

115
Q

Jurisdictions

A

geography where a regulatory or legal body can extend their legal authority

116
Q

Content Types

A

Different categories of a content that a regulatory body can issue.

i.e. legislative materials, regulations, rules

117
Q

The regulatory change management life cycle starts with the regulatory alert record.

A

true

118
Q

Regulatory alert lifecycle

A

new
impact assessment (optional)
In progress
Deferred
Cancelled
Closed

119
Q

Who can can assign an alert record?

A

sn_grc_reg_change.admin or the sn_grc_reg_change.manager (RCM Admin or RCM Manager)

120
Q

Who is assigned to work on an alert?

A

sn_grc_reg_change.user (RCM User)

121
Q

who can cancel an alert?

A

This action is available to managers and users of regulatory event alerts, and to managers of source document alerts

122
Q

Impact Radius Calculation

A

To calculate, the existing regulatory library is searched for the matching citation names, the name of the provider, and the source field.

Based on these results, action tasks are created and recommended by the system.

123
Q

regulatory change task

A

used by the stakeholders to collaborate and craft an action plan.

It serves as the parent for all the action tasks that should be created to complete the identified changes.

124
Q

regulatory change task record lifecycle.

A

New - assigned to RCM user
Respond - calculation of impact radius
Awaiting Approval - RCM Manager approves
Implementation
Closed

125
Q

Source document import task

A

used to ingest a particular source document that is received from the provider into the regulatory library.

126
Q

source document import task lifecycle

A

Ready to import - assigned to RCM User
In progress
Awaiting for Approval - approved by RCM admin or RCM Manager
Implementation (optional)
Closed

127
Q

Action tasks

A

created for regulatory change tasks and source document import tasks.

128
Q

created for regulatory change tasks and source document import tasks.

A

true

129
Q

Types of RCM Application

A

Compliance - contains compliance related action type

Risk - contains all risk-related action tasks

130
Q

Regulatory Calendar

A

The Regulatory Calendar provides an overview of the regulatory tasks. The calendar helps with planning and managing these tasks.

131
Q

Data Quality tab (Audit mngt dashboard)

A

includes important information such as missing information on issues and tasks.

132
Q

Remediation tab (Audit mngt dashboard)

A

displays remediation tasks, including those that are past due.

133
Q

Issues tab (Audit mngt dashboard)

A

provides a snapshot of all issues by engagement, state, and assignee.

134
Q

Control Testing (Audit mngt dashboard)

A

provides control testing status for both effective and non effective controls.

135
Q

Task Management (Audit mngt dashboard)

A

includes details for all audit tasks: Activity, Audit Task, Control Test, Interview, Walkthrough.

136
Q

Audit Engagements (Audit mngt dashboard)

A

provides a big picture of all engagements.

137
Q

Overview (Audit mngt dashboard)

A

displays the audit activities over the course of a year and is helpful for the annual audit planning and monitoring.

138
Q

Audit Manager dashboard

A

includes several tabs for audit managers.

139
Q

Audit Overview dashboard

A

provides an executive view into reports such as engagement results and engagement breakdowns by entities, controls, tasks, and issues.

140
Q

an engagement is closed when

A
  1. engagement is closed as incomplete during the Scope, Validate, or Fieldwork states.
  2. There are no open audit tasks, observations, or issues after the engagement is approved.
  3. All of the follow up tasks, observations and issues are closed.
141
Q

audit engagement lifecycle

A

Scope
Validate and Plan
Fieldwork
Awaiting Approval
Follow up
Closed

142
Q

audit engagement

A

is an audit project that may include audit tasks that accomplish a set of objectives or goals.

are scoped with auditable units or entities

143
Q

audit plan

A

helps to manage different types of audits in a periodic manner and group engagements in a logical manner.

144
Q

auditee

A

the person responsible for providing support during the audit, validating audit findings, and agreeing to audit actions.

145
Q

GRC business user (sn_grc.business_user)

A

Partner with the auditor on the action plan

Respond to observations and evidence requests

Resolve issues converted from the observation

146
Q

External auditor (sn_audit.external_auditor)

A

Assigned as auditor for an engagement and audit tasks

Perform audit against specific regulation

View closed engagements and tasks

147
Q

Engagement project manager (sn_audit_advanced.engagement_project_manager)

A

Complete advanced planning with audit plans and engagements

Create resource and costs plans and approve time cards

148
Q

Audit user (sn_audit.user)

A

Perform fieldwork (walkthroughs, interviews, control testing, etc.)

Document the work and findings

Resolve and/or follow up with audit findings

149
Q

Audit manager (sn_audit.manager)

A

Create audit plans and engagements, including records necessary to conduct the audit, such as milestones, tasks, and evidence requests

Approve audit tasks, workpapers, and engagements

150
Q

Audit Admin (sn_audit.admin)

A

Set up the Audit Management application

Coordinate and facilitate configuration requests

Delete engagements, audit tasks, test templates, and test plans

151
Q

steps to complete typical internal audit

A

Audit Planning
Audit Fieldwork
Follow up
Year End

152
Q

Audit Management

A

uses compliance and risk data to scope, plan, and prioritize audit engagements.

153
Q

risk identification dashboard

A

It helps keep track of various records or objects which are in transit in the risk identification workflow.

154
Q

Risk Register dashboard (Advanced Risk)

A

displays the risk assessments instances in the list view sorted by residual risks.

155
Q

Advanced Risk Assessment Overview dashboard

A

gives an overview of the performance of any risk assessment methodology based on the risk assessment instances.

156
Q

Operational Risk Management dashboard

A

enables an entity owner to view the complete risk posture for the enterprise in a single consolidated report.

157
Q

By building an indicator template, an indicator is also automatically created for every risk scoped with an entity from the related entity type.

A

true

158
Q

Indicator templates

A

recommended to be set up to help generate multiple indicators for similar risks.

set up on a risk statement which is associated to an entity type

159
Q

Scripted indicators

A

use a custom script to collect the data.

160
Q

Basic indicators

A

are automated indicators based on an indicator source.

161
Q

Manual indicators

A

are used for data that cannot be retrieved from a ServiceNow instance because it comes from an external system

162
Q

risk indicator

A

can identify the possibility of a future adverse event. They serve as an early warning system, allowing organizations to take preventative actions.

163
Q

risk transfer

A

Transfer risk to another party or entity

If you select Transfer, the Risk Response Task number prefix is TFT and Task Type is Risk Transfer

164
Q

risk mitigation

A

Deploy mitigating controls

If you select Mitigate, the Risk Response Task number prefix is MGT and Task Type is Risk Mitigation

165
Q

Risk avoidance

A

Reject the risk and deploy measures to avoid risk

If you select Avoid, the Risk Response Task number prefix is AVT and Task Type is Risk Avoidance

166
Q

Risk acceptance

A

Business owner understands and signs of on the risk

If you select Accept, the Risk Response Task number prefix is APT and Task Type is Risk Acceptance

167
Q

risk assessment through risk record

A

can be initiated from the Risk record itself, replacing the classic risk assessment with ARA but keeping the lifecycle on the risk form.

168
Q

Object - based risk assessment

A

tied to a RAM scoped with an object.

Assessors can initiate directly from the object record after configuration is complete.

169
Q

risk assessment scheduler

A

used to initiate risk assessments on multiple entities for all registered risks scoped with those entities.

170
Q

risk assessment scope

A

initiates risk assessments on one entity from an entity class for the set of registered risks scoped with that entity.

allows an entity owner to manage the risk assessments for their assessable entities.

171
Q

Factor contribution type

A

can be qualitative, quantitative, or both. Review the example based on qualitative contribution type.

The response options are Low (L), Medium (M), or High (H)

Each factor has a qualitative weight adding up to 100%

172
Q

Group factors

A

manual or automated factors that are grouped to create a combined score.

173
Q

automated scripted factor

A

type of automated factor that uses scripts to define how a factor will fetch data from ServiceNow records or publicly available data.

174
Q

Automated factors

A

automatically fetch data from ServiceNow tables or databases and from publicly available data that does not reside within ServiceNow.

175
Q

Manual factors

A

require human responses because the questions are subjective and difficult to determine based on data.

176
Q

Policies

A

defines an internal practice that an organization or business process must follow to ensure compliance and reduce risk exposure. Policies can be categorized and related to control objectives.

177
Q

Procedure

A

Fixed, step-by-step sequence of activities or course of action that must be followed to correctly perform a task

178
Q

Standard

A

Documentation of requirements, specifications, guidelines, or characteristics that can be used consistently to ensure that materials, products, processes, and services are fit for their purpose

179
Q

Plan

A

Written account of an intended future course of action aimed to achieve specific goal(s) or objective(s) within a specific timeframe

180
Q

Checklist

A

List of items required to be done to perform a specific task or set of tasks

181
Q

Framework

A

Broad overview or outline of interlinked items that supports a particulate approach to meet a specific objective and serves as a guide to be modified as required

182
Q

Template

A

Design, mold, or pattern of an item or group of items that serves as a basis or guide for designing or constructing similar items

183
Q

Risk management

A

refers to a coordinated set of activities, used by an organization, to control the many risks that could impact their ability to achieve business objectives.

184
Q

Enterprise risk/enterprise risk management

A

to develop a holistic, portfolio view of the most significant risks to the organization.

185
Q

IT Risk

A

any threat to an organization’s data, critical systems and business processes.

186
Q

Operational risk

A

uncertainties and hazards an organization faces when attempting to perform day-to-day business activities.

187
Q

Risk Management and GRC: Advanced Risk applications

A

help to continuously monitor and identify high-impact risks and to improve risk-based decision-making; thereby, reducing reaction time effectively.

188
Q

Benefits of risk management

A

Improved risk-based decisions

Increased productivity

189
Q

Risk assessments

A

performed in virtually every organization and the size and scope of risk assessments vary greatly

190
Q

Principles of Risk Assessment

A

Risk identification

Risk analysis

Risk evaluation

Risk treatment

Risk Monitoring

191
Q

Risk statements

A

a defined consequence that can occur if a threat exploits a vulnerability.

It is a general statement about a potential risk that can occur anywhere in the organization.

serve as a template to generate risks per entity.

192
Q

Risks

A

the likelihood of a given threat against a potential vulnerability and the resulting impact of that adverse event on the organization.

193
Q

Risk frameworks

A

used to categorize risk statements

194
Q

Parent risk statements

A

from GRC: Advanced Risk, can set parent-child relationship between risk

195
Q

Risk applicability

A

determine which risks are applicable by considering their entity framework.

196
Q

Risk Admin (sn_risk.admin)

A

Set up the risk management and advanced risk applications

Coordinate and facilitate configuration requests

Maintain connections across the enterprise and integrations throughout the ServiceNow platform

197
Q

Risk Manager (sn_risk.manager)

A

Create and manage entity types and entity filters

Leverage entity types and entities for scoping

Define risk criteria and overall risk management framework

198
Q

risk user (sn_rick.user)

A

Manage the risks owned by their respective business / assets including identification, assessment, and response

Monitor the progress of the risk response tasks and ensure they are remediated within the timelines

Monitor and escalate the risks to the risk manager which may impact the enterprise

199
Q

Risk reader (sn_risk.reader)

A

Receives read-access to most risk reporting tables and risk dashboards
Generally given to managers and executives to monitor their risk posture

200
Q

GRC Business User (snc_grc.business_user)

A

Respond to risk assessments

Respond to issue tasks, indicator tasks, remediation tasks, and risk event tasks

Report risk events in their business

201
Q

ARA assessor (snc_risk_advanced.ara_assessor)

A

Take assessments

Respond to the assessment

Reassign the assessment

202
Q

ARA Approver (sn_risk_advanced.ara_approver)

A

Approve the assessment

203
Q

Business Operational Risk Manager (sn_risk_workspace.business_op_risk_manager)

A

the risk champions.

They assist operational risk managers and are the first lines of defense for each individual line of business.

They are responsible to manage the risk posture of their specific business units.

204
Q

IT Risk Manager (sn_risk_workspace.IT_risk_manager)

A

the primary person responsible for establishing and maintaining the organization-wide IT risk management program.

205
Q

risk heatmap

A

a data visualization tool that graphically represents an organization’s risk data. The individual values contained in a matrix are shown in colors that denote a meaning.

206
Q

Advanced Risk Assessment

A

contributes to creating an integrated risk platform, supporting various kinds of risk assessment methodologies, and enabling the organization to embed risk assessment in day-to-day operations and influence its overall strategy.

207
Q

RAM (Risk Assessment Methodologies)

A

a unique risk assessment template that can be applied to assess a risk scoped with an entity or an object.

208
Q

risk and control self-assessment (RCSA)

A

to ensure normal business objectives will be met without disruption from unknown or unmitigated risk.

allows an organization to evaluate all risks and control effectiveness related to a specific entity, commonly a line of business (LOB) or department, on a set frequency.

209
Q

Inherent risk assessment type

A

Inherent risk is the risk level without controls or mitigating actions.

210
Q

Control effectiveness assessment type

A

Controls can be preventative, detective, or corrective.

211
Q

Residual risk assessment type

A

the leftover risk after the implementation of controls.

alculated based on the effectiveness of the control(s) and overall inherent risk score.

212
Q

Factors

A

can contribute to either numerical risk score (qualitative contribution) or could be used for calculating annual loss expectancy (ALE) values (quantitative contribution).

Factors can be manual, automated, or grouped.

CIS - ServiceNow (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions