IRM

---

📘 ServiceNow IRM Full Course Notes – 2025 Edition

---

🔹 1. Introduction to IRM

Definition:
IRM (Integrated Risk Management) is a structured approach to managing risk across an enterprise in real-time using workflows, AI, and automation.

Core Pillars:

• Risk Management

• Policy & Compliance Management

• Audit Management

• Vendor Risk Management (TPRM)

• Business Continuity Management

IRM vs GRC:

• GRC: Traditional, siloed

• IRM: Integrated, real-time, scalable with automation & AI

---

🔹 2. Common IRM Terms & Definitions

Term	Description
Entity	Department, vendor, business unit under risk governance
Risk	Potential event with adverse effect
Control	Safeguard to mitigate risk
Indicator	Measurable element to detect risk (KRI, KPI)
Assessment	Process of identifying, evaluating, and prioritizing risk

---

🔹 3. Risk Management

📌 Concepts:

• Risk Types: Operational, Financial, Cyber, Strategic

• Risk Lifecycle:

  • Identification → Evaluation → Response → Monitoring

• Risk Scoring:

  • Qualitative: Low, Medium, High

  • Quantitative: Based on Likelihood × Impact

• Response Types: Accept, Transfer, Mitigate, Avoid

📌 Tables:

Table	Purpose
sn_risk_risk	Risk records
sn_risk_risk_response_task	Response tasks
sn_risk_risk_assessment	Risk assessments

---

🔹 4. Policy and Compliance Management

📌 Concepts:

• Authority Documents: Regulations (e.g., ISO 27001, GDPR)

• Policy Statements: Internal rules based on authorities

• Controls: Implementations ensuring policy enforcement

• Compliance Score: Control effectiveness evaluation

📌 Tables:

Table	Purpose
sn_compliance_compliance_policy	Policies
sn_compliance_control	Control objectives
sn_compliance_issue	Compliance issues

---

🔹 5. Audit Management

📌 Concepts:

• Engagements: Full audit sessions

• Tasks: Individual audit activities

• Findings: Issues identified

• Remediation: Action plans to fix findings

📌 Tables:

Table	Purpose
sn_audit_engagement	Audit engagements
sn_audit_task	Audit tasks
sn_audit_finding	Audit findings

---

🔹 6. Vendor Risk Management (TPRM)

📌 Concepts:

• Vendor Tiering: Classification by criticality

• Assessment Templates: Predefined questionnaires

• Vendor Portal: External access for third-party users

📌 Tables:

Table	Purpose
sn_vdr_risk_vendor	Vendor record
sn_vdr_risk_assessment	Risk assessment
sn_vdr_risk_issue	Vendor risk issues

---

🔹 7. Business Continuity Management (BCM)

📌 Concepts:

• Business Impact Analysis (BIA): Identify critical processes

• BC Plan: Strategy for continuity

• Crisis Management: Emergency handling and escalation

📌 Tables:

Table	Purpose
sn_bcm_bia	BIA records
sn_bcm_plan	Continuity plans
sn_bcm_event	Disruption/crisis events

---

🔹 8. Automation in IRM (Flow Designer + IntegrationHub)

Use Case	Tool	Description
Auto-assign risk response	Flow Designer	Based on scoring rules
Auto-risk scoring	Scripted Rules	Triggered via condition logic
Vendor onboarding	IntegrationHub	Connects with external systems (e.g., SAP, HRMS)
Continuous compliance	Scheduled Jobs	Run daily policy checks and send alerts

---

🔹 9. AI & Predictive Risk

Tool	Use	Example
Predictive Intelligence	Auto-suggest risk categories	Based on past incidents
Virtual Agent	Answer risk/compliance queries	e.g., “Show me open audit issues”
Performance Analytics	Risk heatmaps, dashboards	Live metrics for CROs

---

🔹 10. IRM Dashboards & Reporting

• Compliance Overview Dashboard

• Risk Matrix / Heatmap

• Vendor Risk Scorecards

• Audit Readiness Reports

Tools used: Performance Analytics, Data Sources, Indicators, Widgets

---

🔹 11. Important Scripts / Business Rules (Exam Use)

// Auto-risk score calculation (example)
(function executeRule(current, gsn) {
  if (current.impact == 'High' && current.likelihood == 'Likely') {
    current.score = 90;
  }
})(current, gsn);

// Send notification when audit finding is created
(function executeRule(current, gsn) {
  gs.eventQueue("audit.finding.created", current, current.assigned_to, gs.getUserID());
})(current, gsn);

---

🔹 12. Certifications & Real Projects

🔖 Recommended Certifications:

• ServiceNow Certified Implementation Specialist – Risk & Compliance

• Micro-Certs: Vendor Risk, BCM, Policy Management

🛠️ Project Ideas:

• Automated TPRM Lifecycle

• Risk Scoring + Virtual Agent

• BIA-based BCM Workflow

• Custom Risk Dashboard with PA

---