GRC Overview
About 5% of the CIS-RC exam — see all 7 domains.
GRC = Governance, Risk, and Compliance, the umbrella for ServiceNow's integrated risk applications, now branded Integrated Risk Management (IRM). All applications run on the Now Platform and share the GRC common framework (entities, entity types, indicators, common workflow/data model). Core apps: Policy & Compliance Management, Risk Management (with Advanced Risk), Audit Management, Third-party Risk Management (TPRM; legacy name Vendor Risk Management), Business Continuity Management, Operational Resilience, Privacy Management. Value: a single shared model so controls, risks, audits, and policies reference the same scoped entities and evidence.
Sample questions from this domain
Three of the 15 in this domain, with the reasoning. The full set is in the question bank.
In the ServiceNow GRC/IRM product family, which acronym does GRC stand for?
- A. Governance, Regulation, and Controls
- B. Governance, Resilience, and Compliance
- C. Global Risk and Compliance
- D. Governance, Risk, and Compliance ✓
Why: GRC stands for Governance, Risk, and Compliance, the umbrella for ServiceNow's integrated risk management applications (now branded IRM). Governance, Resilience, and Compliance swaps in resilience, which belongs to the separate Operational Resilience application in the same suite, not to the acronym. Governance, Regulation, and Controls mixes up two things the suite manages (regulations through authority documents, and controls) with the name itself, and Global Risk and Compliance drops governance entirely.
Which platform capability provides the shared data model and engine that GRC applications (Policy and Compliance, Risk, Audit) are built on?
- A. The Smart Assessment Engine and its templates
- B. The CMDB and its configuration item classes
- C. Performance Analytics with GRC indicators
- D. The Now Platform with the GRC core/framework ✓
Why: All GRC applications are built on the Now Platform and share the common GRC framework (entities, indicators, issues, workflow). The Smart Assessment Engine is a shared engine for questionnaires such as attestations and assessments, but it is not the data model the applications are built on. The CMDB is often a source table that entity filters read to generate entities, yet the entities themselves live in the GRC framework. Performance Analytics is an optional reporting layer over GRC data, not the GRC foundation.
A customer wants to manage corporate policies, map them to regulations, and monitor control effectiveness. Which GRC application is the primary fit?
- A. Regulatory Change Management
- B. Third-party Risk Management
- C. Compliance Case Management
- D. Policy and Compliance Management ✓
Why: Policy and Compliance Management handles policies, authority documents and citations, control objectives, controls, attestations, and indicators for compliance monitoring. Regulatory Change Management gathers, monitors, and analyzes regulatory feeds and developments, but the policies and controls themselves live in Policy and Compliance. Third-party Risk Management assesses the risk of third parties, and Compliance Case Management reports, investigates, and resolves compliance cases such as complaints and breaches.