![\"\"](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/10\/image5-1024x165.png\")
![\"\"](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/10\/image2-1-1024x498.png\")
![\"\"](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/10\/image1-1-1024x496.png\")
![\"7](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/10\/7-aspects-of-ServiceNow-Zurich-release-for-Integrated-Risk-Management.jpg\")
<\/a><\/figure>\n\n\t\t\n\t\t- \n
- Risk event summarisation<\/strong> – Instead of manually analysing lengthy records, risk managers can now use Now Assist to instantly generate concise summaries of complex risk events. The AI highlights the root cause, recovery actions, and financial impact, enabling teams to grasp critical details in seconds for faster, more informed decision-making.<\/li>\n\n\n\n
- Regulatory change to control mapping<\/strong> – This feature eliminates the tedious and error-prone process of matching new regulations to internal controls. Now Assist automatically analyses incoming regulatory alerts and suggests relevant business controls that are impacted, making the entire compliance process faster, easier, and more accurate.<\/li>\n\n\n\n
- Control objective rationalisation<\/strong> – To lower the redundant work, Now Assist analyses your entire library of control objectives to find and de-duplicate those that are semantically similar. It then generates a single, consolidated common control objective, reducing the overall number of controls to manage and improving the productivity of your GRC team.<\/li>\n<\/ul>\n\n\n\n
These Now Assist enhancements empower GRC professionals to shift their focus from manual data processing to strategic risk mitigation, building a more efficient and resilient organisation.<\/p>\n\n\n\n
AI Control Tower<\/h2>\n\n\n\n
One of the most interesting recent features is definitely an AI Control Tower. It is a centralised centre to strategically and responsibly manage AI across the whole enterprise. It provides the essential framework for organisations to move beyond simply using AI to actively govern their alignment, risk, and value. Key capabilities include:<\/p>\n\n\n\n
- \n
- Aligning AI strategy with business value<\/strong> – The Control Tower directly links AI initiatives to enterprise goals. It allows you to build strategic roadmaps and, crucially, track the value and productivity delivered by each AI system to drive data-informed decisions on future adoption and investment.<\/li>\n\n\n\n
- Unifying risk, compliance and inventory<\/strong> – Gain a single source of truth by discovering and managing a complete inventory of all AI assets – including those on hyperscalers like AWS Bedrock and Azure – directly within your CMDB. The platform provides real-time visibility into your AI risk posture with extensive scoring, security monitoring, and compliance oversight to ensure responsible and ethical deployment.<\/li>\n\n\n\n
- Enforcing granular LLM control<\/strong> – A key feature is the ability to enforce enterprise policies for Large Language Models (LLMs). You can centrally manage which LLM providers are approved for use and control data routing for AI processing on a regional or global basis, ensuring you meet stringent compliance and data privacy requirements.<\/li>\n<\/ul>\n\n\n\n
The AI Control Tower provides the tools to innovate with confidence, ensuring that your AI is deployed responsibly, ethically, and for maximum business impact.<\/p>\n\n\n\n
Advanced Risk<\/h2>\n\n\n\n
Risk assessment: Grid view<\/h3>\n\n\n\n
ServiceNow Zurich release introduces a new, dynamic grid-based view that gives power users a spreadsheet-style interface for data review and management. This flexible and intuitive format improves evaluation accuracy and improves productivity. It accelerates decision-making and drives greater efficiency and effectiveness in risk management across the organisation:<\/p>\n\n\n\n
- \n
- Flexible, spreadsheet-style risk and control self-assessment (RCSA) for power users to rapidly compare, edit, and prioritise risks and controls (alternative to stacked view)<\/li>\n\n\n\n
- Delivers a focused, Excel-like approach for assessing one risk at a time<\/li>\n\n\n\n
- Supports data-driven assessments, draft mode, and an error validation framework <\/li>\n\n\n\n
- Navigates between lists, show risk details, and control-based assessments\u00a0<\/li>\n\n\n\n
- Provides fast, intuitive risk assessment with bulk editing, side-by-side comparisons, and improved risk prioritisation\u00a0<\/li>\n\n\n\n
- Maintains all stacked view functionalities while offering a more streamlined and flexible user experience<\/li>\n<\/ul>\n\n\n\n
Before, risk and control self-assessments (RCSA) involved evaluating multiple risks and controls through guided workflows and layers of data, which was not a very flexible and efficient way to analyse and prioritise risk information that goes beyond the stacked view. It didn\u2019t offer a high-level, spreadsheet-style interface to more quickly compare, edit, and prioritise risks and controls in a single, consolidated workspace. Now, it gives power users access to a familiar grid or spreadsheet-style interface that streamlines risk prioritisation and data management.<\/p>\n\n\n\n
![\"\"](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/10\/image3-1-1024x391.jpg\")
Risk Assessment, Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n Business outcome:<\/strong><\/p>\n\n\n\n
- \n
- Risks can be evaluated more quickly for faster decisions, particularly in environments with complex assessments.\u00a0<\/li>\n\n\n\n
- Power users improve their productivity and quality of their evaluation analysis.<\/li>\n\n\n\n
- A flexible and intuitive format accelerates decision-making and drives greater efficiency and effectiveness in risk management across the organisation.<\/li>\n<\/ul>\n\n\n\n
TPRM<\/h2>\n\n\n\n
Smart Assessment Engine<\/h3>\n\n\n\n
The Smart Assessment Engine (SAE) has finally found its way to Third-party Risk Management (TPRM) in the Zurich release. This integration fundamentally changes how assessments are conducted, providing a modern and collaborative<\/strong> framework for both internal and external evaluations. Instead of a static process, teams can now use a dynamic, intuitive interface for a more efficient and accurate approach to third-party assessments.<\/p>\n\n\n\n
Before, assessments used a basic, static questionnaire. Templates were less flexible, and there was no built-in support for real-time collaboration. The user interface was clunky and time-consuming.<\/p>\n\n\n\n
The new Smart Assessment Engine offers a modern, intuitive experience. Teams can now co-edit assessments<\/strong> in real-time, with features like an auto-save function and the ability to add attachments directly to questions. You can also bulk-migrate classic templates, making the transition for existing customers much easier.<\/p>\n\n\n\n
![\"\"](\"https:\/\/devoteam.info\/wp-content\/uploads\/2025\/10\/image4-1-1024x568.png\")
Source: ServiceNow<\/figcaption><\/figure>\n\n\n\n Business outcome:<\/strong><\/p>\n\n\n\n
By adopting the Smart Assessment Engine, organisations can significantly improve the efficiency of their third-party risk assessments. The collaborative features reduce the back-and-forth communication typically required, and the enhanced user experience simplifies the process for third-party vendors, leading to faster completion times.<\/p>\n\n\n\n
Smart Assessments enhancements<\/h2>\n\n\n\n
The Zurich release introduces a new \u2018Real-time collaboration\u2019 and \u2018Scoring normalisation\u2019 within SAE core.<\/p>\n\n\n\n
Real-time collaboration for multistakeholder assessments<\/h3>\n\n\n\n
The functionality was designed to transform how multistakeholder assessments are completed:<\/p>\n\n\n\n
- \n
- Enables multiple users to co-author, review, and comment on assessments concurrently within the platform.<\/li>\n\n\n\n
- Reduces the necessity for manual coordination and offline exchanges, thereby enhancing transparency and traceability, making every contributor’s input visible and auditable.<\/li>\n\n\n\n
- Significantly decreases the time required to conclude the assessment.<\/li>\n<\/ul>\n\n\n\n
Business outcome<\/strong>:<\/p>\n\n\n\n
Real-time stakeholder alignment facilitates faster and more accurate assessments, allowing all individuals working with SAE to achieve stronger outcomes and minimise rework.<\/p>\n\n\n\n
Scoring normalisation<\/h3>\n\n\n\n
The new functionality \u2018Scoring Normalisation\u2019 is the process of transforming scores from different scales or formats into a standardised, comparable range.<\/p>\n\n\n\n
When assessment data is collected from diverse teams or domains, assessors frequently encounter varied scoring scales. These may include quantitative scales, such as 1-5 or 0-10, or qualitative scales.<\/p>\n\n\n\n
Normalise scores for accurate insights and smarter decisions can:<\/p>\n\n\n\n
- \n
- Standardises assessment scores from different scales into a common range using the user-defined Normalisation methodology.<\/li>\n\n\n\n
- Removes the complexity of aggregating scores across different scoring scales and methodology.<\/li>\n\n\n\n
- Ability to configure a default normalisation strategy, utilising minimum and maximum scale values, and define how scores should be interpreted within that scale.<\/li>\n\n\n\n
- Establishes a standardised scoring model for consistent metric evaluation, facilitating direct comparisons.<\/li>\n<\/ul>\n\n\n\n
Business outcome<\/strong>:<\/p>\n\n\n\n
Normalisation facilitates the creation of a uniform scoring model, thereby enabling confident comparison of metrics, informed risk prioritisation, and more astute decision-making across the organisation.<\/p>\n\n\n\n
Licensing:<\/strong> Pro or Enterprise only<\/em><\/p>\n\n\n\n
Audit management<\/h2>\n\n\n\n
Test steps in Control testing<\/h3>\n\n\n\n
The Zurich release<\/strong> introduces functionality that enables testers and auditors to define and document the effectiveness of individual test steps while evaluating a control. The functionality defines and documents the effectiveness of individual test steps during control evaluation, allowing for easier identification of root causes on test failure:<\/p>\n\n\n\n
- \n
- Enables auditors to define granular actions for effective control testing.<\/li>\n\n\n\n
- Allows testers to document outcomes for individual test steps during control evaluations.<\/li>\n<\/ul>\n\n\n\n
Before<\/strong>: Auditors needed a way to clearly define and document how effective each test step was during control evaluations. They were looking for templates to automatically create consistent and repeatable test steps, and a method to figure out why a control test failed in the first place.<\/p>\n\n\n\n
After<\/strong>: The new functionality facilitates the definition and documentation of the effectiveness of individual test steps during control evaluations. It utilises predefined test step templates to automatically generate consistent and repeatable test steps. Furthermore, in the event of a control test failure, it simplifies the identification of the failed step and the determination of root causes, thereby reducing the need for rework.<\/p>\n\n\n\n
- Unifying risk, compliance and inventory<\/strong> – Gain a single source of truth by discovering and managing a complete inventory of all AI assets – including those on hyperscalers like AWS Bedrock and Azure – directly within your CMDB. The platform provides real-time visibility into your AI risk posture with extensive scoring, security monitoring, and compliance oversight to ensure responsible and ethical deployment.<\/li>\n\n\n\n
- Regulatory change to control mapping<\/strong> – This feature eliminates the tedious and error-prone process of matching new regulations to internal controls. Now Assist automatically analyses incoming regulatory alerts and suggests relevant business controls that are impacted, making the entire compliance process faster, easier, and more accurate.<\/li>\n\n\n\n