The launch of the ServiceNow Zurich release represents a substantial advancement for organisations utilising its Integrated Risk Management (IRM) suite. Built on a foundation of unification and automation, this update introduces powerful new capabilities designed to streamline governance, risk, and compliance (GRC) processes and improve organisational resilience. Let’s take a look at the most interesting enhancements below.
Now Assist IRM
ServiceNow Zurich release introduces a number of enhancements when it comes to its AI capabilities. The most important ones are:
- Risk event summarisation – Instead of manually analysing lengthy records, risk managers can now use Now Assist to instantly generate concise summaries of complex risk events. The AI highlights the root cause, recovery actions, and financial impact, enabling teams to grasp critical details in seconds for faster, more informed decision-making.
- Regulatory change to control mapping – This feature eliminates the tedious and error-prone process of matching new regulations to internal controls. Now Assist automatically analyses incoming regulatory alerts and suggests relevant business controls that are impacted, making the entire compliance process faster, easier, and more accurate.
- Control objective rationalisation – To lower the redundant work, Now Assist analyses your entire library of control objectives to find and de-duplicate those that are semantically similar. It then generates a single, consolidated common control objective, reducing the overall number of controls to manage and improving the productivity of your GRC team.
These Now Assist enhancements empower GRC professionals to shift their focus from manual data processing to strategic risk mitigation, building a more efficient and resilient organisation.
AI Control Tower
One of the most interesting recent features is definitely an AI Control Tower. It is a centralised centre to strategically and responsibly manage AI across the whole enterprise. It provides the essential framework for organisations to move beyond simply using AI to actively govern their alignment, risk, and value. Key capabilities include:
- Aligning AI strategy with business value – The Control Tower directly links AI initiatives to enterprise goals. It allows you to build strategic roadmaps and, crucially, track the value and productivity delivered by each AI system to drive data-informed decisions on future adoption and investment.
- Unifying risk, compliance and inventory – Gain a single source of truth by discovering and managing a complete inventory of all AI assets – including those on hyperscalers like AWS Bedrock and Azure – directly within your CMDB. The platform provides real-time visibility into your AI risk posture with extensive scoring, security monitoring, and compliance oversight to ensure responsible and ethical deployment.
- Enforcing granular LLM control – A key feature is the ability to enforce enterprise policies for Large Language Models (LLMs). You can centrally manage which LLM providers are approved for use and control data routing for AI processing on a regional or global basis, ensuring you meet stringent compliance and data privacy requirements.
The AI Control Tower provides the tools to innovate with confidence, ensuring that your AI is deployed responsibly, ethically, and for maximum business impact.
Advanced Risk
Risk assessment: Grid view
ServiceNow Zurich release introduces a new, dynamic grid-based view that gives power users a spreadsheet-style interface for data review and management. This flexible and intuitive format improves evaluation accuracy and improves productivity. It accelerates decision-making and drives greater efficiency and effectiveness in risk management across the organisation:
- Flexible, spreadsheet-style risk and control self-assessment (RCSA) for power users to rapidly compare, edit, and prioritise risks and controls (alternative to stacked view)
- Delivers a focused, Excel-like approach for assessing one risk at a time
- Supports data-driven assessments, draft mode, and an error validation framework
- Navigates between lists, show risk details, and control-based assessments
- Provides fast, intuitive risk assessment with bulk editing, side-by-side comparisons, and improved risk prioritisation
- Maintains all stacked view functionalities while offering a more streamlined and flexible user experience
Before, risk and control self-assessments (RCSA) involved evaluating multiple risks and controls through guided workflows and layers of data, which was not a very flexible and efficient way to analyse and prioritise risk information that goes beyond the stacked view. It didn’t offer a high-level, spreadsheet-style interface to more quickly compare, edit, and prioritise risks and controls in a single, consolidated workspace. Now, it gives power users access to a familiar grid or spreadsheet-style interface that streamlines risk prioritisation and data management.
Business outcome:
- Risks can be evaluated more quickly for faster decisions, particularly in environments with complex assessments.
- Power users improve their productivity and quality of their evaluation analysis.
- A flexible and intuitive format accelerates decision-making and drives greater efficiency and effectiveness in risk management across the organisation.
TPRM
Smart Assessment Engine
The Smart Assessment Engine (SAE) has finally found its way to Third-party Risk Management (TPRM) in the Zurich release. This integration fundamentally changes how assessments are conducted, providing a modern and collaborative framework for both internal and external evaluations. Instead of a static process, teams can now use a dynamic, intuitive interface for a more efficient and accurate approach to third-party assessments.
Before, assessments used a basic, static questionnaire. Templates were less flexible, and there was no built-in support for real-time collaboration. The user interface was clunky and time-consuming.
The new Smart Assessment Engine offers a modern, intuitive experience. Teams can now co-edit assessments in real-time, with features like an auto-save function and the ability to add attachments directly to questions. You can also bulk-migrate classic templates, making the transition for existing customers much easier.
Business outcome:
By adopting the Smart Assessment Engine, organisations can significantly improve the efficiency of their third-party risk assessments. The collaborative features reduce the back-and-forth communication typically required, and the enhanced user experience simplifies the process for third-party vendors, leading to faster completion times.
Smart Assessments enhancements
The Zurich release introduces a new ‘Real-time collaboration’ and ‘Scoring normalisation’ within SAE core.
Real-time collaboration for multistakeholder assessments
The functionality was designed to transform how multistakeholder assessments are completed:
- Enables multiple users to co-author, review, and comment on assessments concurrently within the platform.
- Reduces the necessity for manual coordination and offline exchanges, thereby enhancing transparency and traceability, making every contributor’s input visible and auditable.
- Significantly decreases the time required to conclude the assessment.
Business outcome:
Real-time stakeholder alignment facilitates faster and more accurate assessments, allowing all individuals working with SAE to achieve stronger outcomes and minimise rework.
Scoring normalisation
The new functionality ‘Scoring Normalisation’ is the process of transforming scores from different scales or formats into a standardised, comparable range.
When assessment data is collected from diverse teams or domains, assessors frequently encounter varied scoring scales. These may include quantitative scales, such as 1-5 or 0-10, or qualitative scales.
Normalise scores for accurate insights and smarter decisions can:
- Standardises assessment scores from different scales into a common range using the user-defined Normalisation methodology.
- Removes the complexity of aggregating scores across different scoring scales and methodology.
- Ability to configure a default normalisation strategy, utilising minimum and maximum scale values, and define how scores should be interpreted within that scale.
- Establishes a standardised scoring model for consistent metric evaluation, facilitating direct comparisons.
Business outcome:
Normalisation facilitates the creation of a uniform scoring model, thereby enabling confident comparison of metrics, informed risk prioritisation, and more astute decision-making across the organisation.
Licensing: Pro or Enterprise only
Audit management
Test steps in Control testing
The Zurich release introduces functionality that enables testers and auditors to define and document the effectiveness of individual test steps while evaluating a control. The functionality defines and documents the effectiveness of individual test steps during control evaluation, allowing for easier identification of root causes on test failure:
- Enables auditors to define granular actions for effective control testing.
- Allows testers to document outcomes for individual test steps during control evaluations.
Before: Auditors needed a way to clearly define and document how effective each test step was during control evaluations. They were looking for templates to automatically create consistent and repeatable test steps, and a method to figure out why a control test failed in the first place.
After: The new functionality facilitates the definition and documentation of the effectiveness of individual test steps during control evaluations. It utilises predefined test step templates to automatically generate consistent and repeatable test steps. Furthermore, in the event of a control test failure, it simplifies the identification of the failed step and the determination of root causes, thereby reducing the need for rework.
Business outcome:
Utilising predefined templates for test steps and plans, users can ensure consistent and repeatable test step generation automatically across all controls.
Entity Based Access
Entity Based Access (EBA) provides a structured way to segregate data based on your organisational model. Entities represent business units, regions, or departments, and users or groups can be assigned to them. Once enabled, any records tied to an entity – such as risks, controls, issues, or audit records – are only accessible to those users.
This approach ensures that visibility of sensitive information follows organisational lines. Entities themselves remain visible on the platform, but the records connected to them are filtered out unless a user has explicit rights. For example, a risk tied to the Finance entity can only be accessed by Finance users, while HR users won’t see it even if they hold general risk roles.
But with the Zurich release, ServiceNow significantly broadened and simplified the use of EBA:
- Extended scope – EBA now covers not only core GRC records, but also audit-related tables, metric definitions, metric tasks, and metric data. This extension makes entity-based access a cross-module feature rather than something limited to risk and compliance.
- Bulk management – Administrators can update user–entity assignments in bulk, reducing the manual effort of managing large-scale environments with many entities.
- IRM integration – EBA is now aligned with other IRM capabilities, including risk matrices and advanced risk features. This makes it easier to apply entity-based restrictions consistently when assessing or scoring risks.
- Guided utilities – The release adds guided steps for applying record-level access updates, helping administrators roll out EBA more reliably and with fewer errors.
The expansion of EBA in Zurich creates several tangible advantages:
- Reduced admin effort – Bulk updates and guided utilities cut down the time required to configure and maintain EBA.
- Granularity – Access is no longer just role-based but tied to the real organisational structure.
- Consistency – Rules apply automatically to new records, ensuring ongoing alignment.
- Cross-module security – Metrics, audit records, and risks are all governed by the same framework.
There are also practical aspects to keep in mind:
- Existing data – Records created before EBA is applied may need to be updated (backfilled) so they follow the new rules.
- Layered controls – EBA does not replace ACLs, roles, or confidentiality settings; these continue to apply and can overlap. Testing is necessary to confirm expected outcomes.
- Performance – Large implementations with hundreds of entities and thousands of records require planning to avoid access-query performance issues.
- User awareness – Because entities themselves remain visible, users may still see entities they don’t have access to – but without the ability to open related records. This can require communication to avoid confusion.
Business outcome:
Zurich elevates EBA from a niche feature into a central access control mechanism for IRM. By tying record visibility directly to organisational entities, companies can better align governance to business structures, reduce the risk of inappropriate data exposure, and simplify administration. The result is a more secure and scalable approach to managing access across risks, controls, metrics, and audits.
Conclusion
In summary, the ServiceNow Zurich release delivers a comprehensive and strategic leap forward for Integrated Risk Management. The seven key aspects discussed – particularly the integration of Now Assist GenAI for automating control processes and significant enhancements to core areas like Audit Management and Third-Party Risk—collectively empower organisations to move beyond traditional, reactive GRC. By adopting these powerful new features, businesses can transform their risk program into a proactive, efficient, and deeply integrated system, ensuring risk-informed decisions are embedded into daily operations across the enterprise.