Creating a ServiceNow-Managed Audit

Overview

After ServiceNow and ZenGRC are connected, you can create and manage audits inside ZenGRC while requests for audit information show up in visual task boards inside ServiceNow. This documentation outlines that process.

Step 1: Adding Basic Audit Information

To create a ServiceNow audit, complete the following steps:

1. In the left-hand navigation, click New | Audit.
   
   
   
   

2. Complete the fields. If you prefer to have all controls available for selection in Step 2, then leave the Related Program field empty.

3. Select ServiceNow, in the Managed in drop-down. The audit will be represented as a guided visual task board in ServiceNow, with each request shown as a task.

4. To view comments and attachments added by ServiceNow users, click the Synchronize comments and Synchronize attachments toggles. This can also be done after the audit is started.
   
   
   
   

5. Click Save.
   
   

   NOTE

   For complete instructions on this step, please see Step 1: Adding Basic Audit Information.

Step 2: Defining the Scope

Step 2 in audit creation is the same for ServiceNow and regular audits.

Step 3: Setting up Audit Requests - ServiceNow

The majority of Step 3 follows general instructions outlined in audits. The differences are described below.

1. The ServiceNow requests template differs from regular audits, so be certain to download the template for population as outlined in Step 3: Setting up Audit Requests.
2. The template supports the following user assignments for requests:
   • ServiceNow individual users can populate the Assigned To column.
   • ServiceNow groups can populate the Assignment column.
   • Use these users and groups together or separately on requests. If used together, be certain the user exists in the group assignment.
   • Each need to exist in ServiceNow but not in ZenGRC.
   • ZenGRC does not validate these fields, so they must be specified correctly in the CSV.
     
     
     
     
3. Import the CSV as normal.
4. Click Import Data.
5. In our CSV example, requests are mapped to controls in the Mapped Controls column, which allows you to skip the mapping done after import. If this column is blank, you will need to map controls at this point.
6. Click Next.
   
   

Step 4 and 5

Step 4 and 5 in audit creation are the same for ServiceNow and regular audits.