Regulatory alerts
Summarize
Summary of Regulatory alerts
Regulatory alerts in the ServiceNow Regulatory Change Management application aggregate regulatory events and documents from multiple intelligence providers. These alerts keep users informed about frequent regulatory changes by presenting updated information in regulatory alert records. Each alert contains metadata to help stakeholders interpret changes, plan actions, and implement compliance measures effectively.
Show less
Types of Alerts and Associated Regulatory Tasks
- Regulatory event alerts: These provide general updates and insights on regulatory changes, created from RSS feeds by default.
- Source document alerts: These indicate changes to specific citations within authority documents, available when integrated with third-party providers such as Thomson Reuters via the Unified Compliance Framework (UCF).
Each alert type triggers specific regulatory tasks upon being marked applicable by users with appropriate roles (sngrcregchange.user or sngrcregchange.admin):
- Regulatory change task: Created for regulatory event alerts to assess changes and update GRC objects like policies, controls, and risk statements.
- Source document import task: Created for source document alerts to update or insert citations into the regulatory library.
Alerts, User Roles, and Actions
Alerts can be assigned or unassigned. Assigned alerts have a Coordinator and are linked to users with roles such as sngrcregchange.manager, user, or admin. Unassigned alerts can be acted upon with options like Update, Mark Applicable, Defer, Initiate Impact Assessment, Mark Not Applicable, Cancel, or Delete.
Marking an unassigned alert as applicable creates the relevant regulatory task. Alerts marked not applicable are closed with comments. Assigned alerts progress through states including New, Deferred, Impact Assessment, In Progress, and Closed.
Role-based access is as follows:
- Users with sngrcregchange.admin or manager roles can access all alerts.
- Users with sngrcregchange.user role can view only alerts assigned to themselves.
Maintenance and Automation
The application provides table cleaners to automatically purge alerts marked not applicable and processed registry file records. Only users with the admin role can schedule and execute these cleanups to maintain data hygiene.
Practical Usage and Enhancements
- Users can perform various actions on alerts, such as assigning alerts, initiating impact assessments, and marking applicability.
- The GRC: Predictive Intelligence application supports adding AI-recommended citations to regulatory alerts for enhanced accuracy.
- Machine learning can be enabled via the Governance, Risk, and Compliance Predictive Intelligence plugin to automatically recommend citations on alerts, improving efficiency.
- Both regulatory event alerts and source document alerts can be managed and assigned to appropriate users for timely processing.
Regulatory alerts are an aggregation of different regulatory events and documents that are sourced from multiple regulatory intelligence providers. Similar to web feeds, a regulatory alert is a record of these regulatory changes. Such changes are frequently updated, and the alerts help you stay informed about the regulatory landscape.
The Regulatory Change Management application transforms and maps the alerts. The application provides the information in regulatory alert tables.
The Regulatory Change Management life cycle starts with the regulatory alert record. Each regulatory alert record contains metadata that helps stakeholders to translate the changes, create an action plan, and implement actions to comply with the regulatory changes.
With the Regulatory Change Management application, you can use the regulatory alerts to inform the users about regulatory updates.
Types of alerts and associated regulatory tasks
Different types of alerts are displayed under the Regulatory Alerts module in the Regulatory Change Management application.
- Regulatory event alerts: Signify alerts, provide updates to news, and provide insights on regulatory changes. Alerts are by default regulatory event alerts. All RSS feeds result in a regulatory alert record.
- Source document alerts: Signify changes to the citations. Citations are like various sections of an authority document. ServiceNow® GRC offers the Network Frontiers Unified Compliance Framework (UCF) integration. The integration creates authority documents after the import, and it creates corresponding citations under each authority document. When an existing citation is updated or a new citation is inserted, it signifies a change in the source document. Source document alerts are only available when integrating with a third-party regulatory intelligence provider; for example, Thomson Reuters.
The difference between a regulatory event alert and a source document alert is scope. Regulatory event alerts signify general alerts for general changes and for upcoming regulatory changes. In contrast, source document alerts signify changes that are specific to the citations. When an existing citation is updated or a new citation is inserted, it signifies a change in the source document.
- Regulatory change task: This task is created for regulatory event alerts. The task is used to evaluate the changes and to update the GRC objects, such as policies, controls, and risk statements in the library.
- Source document import task: This task is created for source document alerts. The task is used to update an existing citation or to insert a new citation that is received from the provider into the regulatory library.
Alerts and user roles
Alerts can have different states. The main property of an alert is whether it’s assigned or unassigned. For assigned alerts, the Coordinator field has a value. An alert can be assigned either to a user with the sn_grc_reg_change.manager role or the sn_grc_reg_change.user or sn_grc_reg_change.admin role. In contrast, an unassigned alert isn’t assigned to anyone.
- Update
- Applicable
- Defer
- Initiate Impact Assessment
- Not Applicable
- Cancel Regulatory Alert
- Delete
When an unassigned regulatory event alert is marked as applicable, a regulatory change task is created. When an unassigned source document alert is marked as applicable, a source document import task is created.
When an unassigned alert is marked as not applicable with due comments, its state is updated as Closed in the regulatory alert form.
- New
- Deferred
- Impact Assessment
- In Progress
- Closed
In terms of user roles, all alerts can be accessed by users with either the sn_grc_reg_change.admin role or the sn_grc_reg_change.manager role. Users with the sn_grc_reg_change.user role can view assigned alerts that are assigned to them, but they can’t view unassigned alerts or alerts that are assigned to other people.
Table cleaners for regulatory alerts
The alert records that are marked as not applicable must be cleaned at regular intervals. The Regulatory Change Management application provides table cleaners for cleaning the alert records automatically. Users specify the time and frequency for the cleanup activity. Only users with the sn_grc_reg_change.admin role can perform cleanup activities.
Similarly, registry file records that have been processed can be cleaned at specified time intervals.