Audit Management Implementation
About 5% of the CIS-RC exam — see all 7 domains.
Audit Management plans and executes internal/external audits leveraging the same scoped entities and controls.
Key objects:
- Engagement: the audit project/scope (advanced planning lets you scope by entities, risks, controls).
- Audit Plan / Audit Universe: what could be audited and the planned schedule.
- Audit tasks / fieldwork: execution steps and working papers / evidence.
- Observations and issues: results of testing, interviews, and walkthroughs are recorded as audit observations; an observation confirmed as an issue (or a control test closed as Ineffective) drives remediation.
- Risk-based auditing: audits draw on the risk register and control test results so audit, risk, and compliance reuse the same data.
Exam gotcha: Audit reuses GRC controls, entities, and indicators; it does not maintain a separate parallel control universe.
Sample questions from this domain
Three of the 15 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of Audit Management in ServiceNow GRC?
- A. To attest to controls and track the compliance status of policies
- B. To plan, scope, execute, and report on internal audit engagements ✓
- C. To identify, assess, and respond to risks across the risk register
- D. To plan, exercise, and recover business processes after disruption
Why: Audit Management plans, scopes, executes, and reports on internal audit engagements, from audit plans through fieldwork, approval, follow up, and audit reports. Control attestation and compliance status are the purpose of Policy and Compliance Management. Identifying, assessing, and responding to risks is Risk Management. Planning, exercising, and recovering business processes is Business Continuity Management.
In Audit Management, what is an engagement?
- A. A yearly program that groups many audits with their projected costs, resources, and timelines
- B. A single unit of audit work, such as a control test, interview, or walkthrough, for one auditor
- C. An auditable area, such as a department or vendor, that is risk assessed to decide what to audit
- D. A defined audit project with scope, schedule, and tasks to evaluate controls/areas ✓
Why: An engagement is a defined audit project with scope, schedule, and tasks; it moves through the Scope, Validate, Fieldwork, Awaiting Approval, Follow Up, and Closed states. A yearly program that groups audits with costs and resources is an audit plan, which contains engagements. A single control test, interview, or walkthrough is an audit task completed within an engagement. An auditable unit (with GRC Advanced Audit) is an area that is risk assessed to decide whether to audit it and can be scoped into an engagement, but it is not the engagement.
How does Audit Management leverage the shared GRC framework when scoping an engagement?
- A. It can scope to entities and reference existing controls and risks rather than recreating them ✓
- B. It imports copies of the in-scope controls into the engagement so that audit results stay apart from compliance
- C. It scopes to authority documents, then generates new audit controls from the citations that they hold
- D. It scopes to entity classes, so each class holds the controls and risks that the auditors test
Why: Audit engagements scope to entities, and in the Validate state the risks, controls, test plans, and indicator results of the in-scope entities are associated with the audit, so existing records are referenced rather than recreated. The engagement does not import copies of controls; the same control records are tested. Authority documents and citations are mapped to control objectives; an engagement does not generate new controls from citations. Entity class is a tag for grouping entities; engagements scope entities themselves, and controls and risks belong to entities, not to classes.