Risk and Compliance Practice Test

Skills this practice test covers

• Scope entities with the Entity Type approach or the Entity Class approach.
• Map authority documents and citations to control objectives and the controls they generate.
• Configure Classic Risk Assessment and Advanced Risk Assessment, from risk statements to scored risks.
• Assign GRC groups and roles to the risk and compliance personas of an implementation.
• Follow an audit from planning and fieldwork to findings and remediation.
• Set up continuous monitoring, content packs and Regulatory Change Management.

7 domains · 45 topics · 134 of 156 questions sorted by domain

Requirements

• Recommended: six months of field experience on at least two ServiceNow deployment projects, or maintaining ServiceNow instances.
• Recommended: the ServiceNow Administration Fundamentals course or the Certified System Administrator certification.
• Recommended: the GRC: Integrated Risk Management (IRM) Fundamentals and IRM Implementation courses, plus the IRM Simulator.

About the CIS-RC exam

How to earn the certification

Earns

ServiceNow Certified Implementation Specialist - Risk and ComplianceSpecialist

The certification stays current while the holder passes annual maintenance exams and pays the yearly Certification Maintenance Program fee.

Before

• CSA Certified System Administrator

  Covers ServiceNow platform administration. CSA, or the Administration Fundamentals course, is the base that CIS-RC builds on.

How to prepare for CIS-RC

1. 1

   Scope entities in the IRM Simulator

   Use the GRC: IRM Simulator to create an entity type, an entity filter and a class rule, then check which entities appear. Entity scoping returns in many policy and risk questions, so it pays to learn it first.

2. 2

   Trace one regulation to its controls

   Follow one authority document from its citations to a control objective, and on to the controls generated for each entity. Then run an attestation on one control and raise an issue from a failed answer.

3. 3

   Score one risk both ways

   Assess the same risk with Classic Risk Assessment and with Advanced Risk Assessment, and compare the inherent and residual results. The Policy and Compliance domain and the Risk and Advanced Risk domain carry the most weight, so give them the most time.

4. 4

   Learn the GRC tables and roles

   List the main tables in each scope and the roles that each GRC role inherits, such as the reader roles that come with sn_audit.user. Flashcard Mode works well for these exact names.

5. 5

   Time a full CIS-RC practice run

   Take the CIS-RC practice test in Timed Mode, then reread the explanation for each missed table, role or lifecycle question. Ask Brainy AI Assistant to walk through any record lifecycle that is still unclear.

   Start a timed CIS-RCrun

ServiceNow's blueprint recommends GRC: Integrated Risk Management (IRM) Fundamentals, GRC: IRM Implementation, GRC: Classic Risk Assessment Fundamentals, GRC: Audit Management Essentials, GRC: Regulatory Change Management Essentials and the GRC: IRM Simulator.

Who CIS-RC is for

• ServiceNow partner consultants who implement GRC applications for clients.
• Customer administrators who maintain the Risk, Policy and Compliance, and Audit Management applications.
• Risk and compliance managers who own the GRC requirements on a ServiceNow project.
• Internal audit teams who move their audit work onto ServiceNow.

Typical job titles: GRC implementation consultant · ServiceNow GRC developer · ServiceNow administrator · Risk management consultant · Compliance manager · GRC architect

CIS-RC glossary

19 terms from the exam objectives and the vendor's official material, each defined in a sentence.

Advanced Risk Assessment

The newer, configurable assessment engine, built on risk assessment methodologies with steps such as inherent, control and residual assessment.

Attestation

A questionnaire that a control owner completes to confirm that a control is designed and working.

Authority Documents

Records for external regulations, standards and frameworks, broken down into citations for each requirement.

Class rules

Rules in the Entity Class approach that follow relationships between records to create related entities and link them.

Classic Risk Assessment

The original ServiceNow risk assessment, which rates each risk for likelihood and impact against defined criteria.

Content Packs

Prebuilt dashboards and reports for the GRC applications that can be activated and then adjusted.

Continuous Monitoring

Scheduled, automatic checks that use platform data to test controls and flag failures without a manual review.

Control Objectives

Statements of what a control must achieve. GRC generates a control from each control objective for every entity in scope.

Entity Class approach

A scoping method that sorts entities into classes and uses class rules to create entities and their relationships automatically.

Entity Filter record

A record that selects entities by conditions on a source table. The source table is its mandatory field.

Entity Type approach

A scoping method in which each entity type names a table and conditions, and matching records become entities of that type.

Heat maps

Charts that place risks on a grid of likelihood and impact, so the highest risks stand out.

Inherent risk

The level of a risk before any controls reduce it.

Issues

Records of problems found by control tests, attestations, audits or risk assessments, tracked until they are fixed.

Regulatory Change Management

The GRC application that tracks changes to regulations and sends each change to its owners for an impact review.

Residual risk

The level of a risk that remains after controls are in place.

Risk Framework

A record that groups related risk statements, much as a policy groups control objectives.

Risk Statement

A general description of a risk, from which GRC generates a risk record for each entity in scope.

Unified Compliance Framework (UCF)

A library of authority documents and common controls. With the UCF integration, its controls import into the Control Objectives table.