ServiceNow

The user experience of ServiceNow products is of inherently integrated processes, with a consistent approach to design, look and feel. This can help users minimise costly delays or confusion caused by difficulties using potentially complex business processes such as those around GRC functions. IRM, and other ServiceNow products, are appropriate for any size of organisation, from the largest multi-nationals to mid-sized enterprises. Around 75% of ServiceNow customers pay less than $1 million annually in subscriptions, illustrating this diversity in its user base.

Other ServiceNow process areas (e.g. customer service, service desk, HR, IT security, and financial operations) can readily integrate with GRC processes, increasing the value gained from investments in risk and compliance insight. An example would be to invoke a risk assessment process during a generic business process such as customer onboarding. Similarly, risk data can be embedded within processes and decision-making, which can reduce costs (e.g. of compliance) – and ServiceNow provides pre-built integrations of risk-related information for many critical use cases such as security incident investigation, and application risk assessment.

AI is already incorporated within operational GRC processes, helping to streamline tasks. Examples of its use include categorisation of risk, identifying trends relating to loss events, suggesting remediation plans that might helpfully be reused, and providing predictive help for selecting appropriate ownership of risk.

ServiceNow is one of only two major players in the GRC space that also provide other solution types. All the dozens of others are pure-play GRC vendors. That may change as the market continues growth towards greater maturity, but currently most ServiceNow customers enjoy a unique benefit – all the base data that enables GRC solutions to deliver organisation-specific insight and value can be leveraged by many other enterprise solutions, via ServiceNow’s platform approach. Evidently, with around 1400 customers using IRM and related risk solutions, the multiplying advantage (and ongoing cost-saving) of only making that investment once makes sense to many organisations.

Prominent executives from competing, pure-play GRC vendors have moved to senior positions, and subsequently stayed, with ServiceNow in recent years. In this period, the functional scope of the Integrated Risk Management offerings has increased considerably. This suggests that ServiceNow is appropriately and strongly invested in this market area, at a time when GRC is becoming a more important priority for enterprises globally.

My question of the company over a number of years has been whether it is only existing ServiceNow customers who would find the best advantage from implementing IRM as their GRC solution of choice. The answer from the company is now very clear – that for some customers, IRM is the initial attraction to ServiceNow, and the first functional area in which they adopt ServiceNow solutions. Part of that attraction may well be the depth of integration between IRM and other ServiceNow offerings, which provides the easiest way to foster a standard risk taxonomy coming into use across the enterprise. The major advantage of that is to smooth and improve the overall integration of risk management across organisational areas, with fewer mistakes and lower cost likely.