Security and risk · LessonBy Sneha I, ServiceNow Trainer, 8 yrs · Published · ServiceNow · all levels
Audit Management
Plan audits, run engagements, gather evidence and track findings to closure inside the platform.
Quick answer
Plan audits, run engagements, gather evidence and track findings to closure inside the platform.
Key takeaways
- Engagements link to entities and controls
- Continuous control testing reduces fieldwork
- Findings need owners, dates and evidence to close
- Trend findings by control to spot systemic weakness
Audit lifecycle
Audit management covers planning, scoping, fieldwork, findings and reporting. Engagements link to entities and to the controls being tested, which means evidence gathered for compliance can be reused rather than requested again.
Evidence reuse
When control tests already run continuously, an audit becomes a review of existing results plus targeted sampling. That is the biggest efficiency gain available to a GRC programme.
Findings
Findings are the output that matters.
- Assign each finding an owner, a due date and an agreed action
- Link findings to the control that failed so trend analysis works
- Track overdue findings on a dashboard the audit committee sees
- Close findings on evidence, not on assurance from the owner
Practice challenge
+0 XPStreak ×0
Question 1 of 2
What should close a finding?
Frequently asked questions
Do auditors need platform access?
Give them a read only role scoped to audit records. That is usually enough and beats emailing exports.
How does this connect to compliance?
Both use the same controls and entities, so evidence and results are shared rather than duplicated.