‹ All interview questions

Security

In a large financial services ServiceNow production instance, your GRC Audit Management app shows 15% of…

Senior · ServiceNow · Feb 2026

The question

In a large financial services ServiceNow production instance, your GRC Audit Management app shows 15% of controls (120 out of 800) failing automated compliance tests over the last quarter. Auditors report gaps in evidence collection for high-risk controls linked to sn_grc_control and sn_grc_audit_engagement tables. Manual reviews reveal inconsistent control testing workflows, with some engagements stuck in 'Fieldwork' state due to missing evidence uploads. PPM plugin is active, but resource tracking via time cards shows 20% unapproved entries. Leadership demands root cause analysis, remediation options with trade-offs, and a production-safe fix to reduce gaps below 5% within 30 days. 1. Outline your diagnosis approach (tools/logs/steps) to pinpoint root causes. 2. Propose 3 solution options (e.g., workflow automation, ACL tweaks, reporting) with pros/cons and scalability trade-offs. 3. Provide a Business Rule script (8-12 lines) that demonstrates the core issue (e.g., evidence validation failure) and your recommended fix. Explain *why* it addresses the root cause. 4. Discuss production rollout considerations (testing, rollback, monitoring) and edge cases (e.g., bulk imports, role-based access).

Context

In this scenario, auditors face systematic compliance gaps from unvalidated evidence in control tests, stalled engagements, and poor resource tracking. Root causes likely include: (1) missing server-side validation on evidence uploads to sn_grc_control_test_result, allowing incomplete records; (2) workflow blockers in Audit Engagement states without auto-escalation; (3) unapproved time cards skewing PPM resource allocation. Diagnosis starts with Audit Workspace dashboards for gap visualization, then Security Debug for ACL issues, and Logs/System Diagnostics for script errors. Query audit_engagement and control tables for patterns (e.g., WHERE state='fieldwork' AND evidence_count=0).

The Solution

Option 1: UI Policy + Client Script for mandatory evidence (quick, but UI-only, skips API imports).
Option 2: Scheduled Job for retroactive validation (batches gaps, but high load on prod).
Option 3: Business Rule on sn_grc_control_test_result (after insert/update) – enforces server-side integrity (scalable, audit-proof).

// PROBLEM: Original BR allowing null evidence (causes 15% gaps)
// (function executeRule(current, previous /*null when async*/) {
//     if (!current.evidence_file) current.state = 'pending'; // Weak, no enforcement
// })(current, previous);

// SOLUTION: Robust validation + auto-notify
(function executeRule(current, previous /*null when async*/) {
    if (current.state.changesTo('complete') && !current.evidence_file && current.risk_level == 'high') {
        current.state = 'failed'; // Block completion
        current.comments = 'Evidence required for high-risk controls per compliance policy.';
        // Fire the event once; an Email Notification record
        // (sysevent_email_action) subscribed to this event
        // notifies the control owner and leaves an audit trail
        gs.eventQueue('control.evidence.missing', current, current.getValue('control_owner'), '');
    }
})(current, previous);

Why this works: Server-side enforcement prevents invalid states (root cause), auto-notifies owners (fixes workflow stalls), and logs events for PPM/audit trails. Trade-off: Minimal perf hit vs. full workflow rebuild.

Senior Considerations

  • Diagnosis depth: Checking dashboards is table stakes — cross-reference with sys_audit deletes, ACL debug, and PA indicators for unapproved time cards linking to resource gaps.
  • Trade-offs: Don't just pick one option — compare rough runtime costs (a lightweight per-record BR check vs. a heavy hourly batch job) and tie the choice to Next Experience UX (Workspace record pages).
  • Production rollout: Test in sub-prod with bulk evidence imports; use Update Sets with conditions; monitor via Event Logs/Perf Analytics. Rollback: Toggle BR active=false.
  • Edge cases: API bulk creates (use Transform Map), role overrides (admin ACL bypass?), offline evidence (integrate Doc Mgmt). Great answers discuss GRC-PPM plugin sync and SOX compliance implications.
  • Scalability: Index evidence_file/risk_level; limit notifications to avoid spam; integrate with Flow Designer for state transitions.