ServiceNow CIS-GRC - Risk and Compliance Implementation

By IAmtheCheese · Updated Jun 9, 2026

CertificationCIS – Risk and Compliance (CIS-RC)
Questions160
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,579
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
Log in to rate

Certification Summary

The ServiceNow Certified Implementation Specialist - Risk and Compliance exam targets consultants tasked with building and configuring the GRC suite, rather than those who simply navigate the interface. Most people take this because a partner status requires a specific number of certified bodies, so expect questions that assume you know how to map control objectives to entities without breaking the underlying table structure.

Expect the exam to focus on Entity Scoping, Policy and Compliance, and Risk Implementation, which account for 75 percent of the content. The remaining sections cover GRC Overview, Implementation Planning, Audit Management, and Extended Capabilities. You will need to demonstrate how to configure the relationship between control tests and audit engagements within the GRC module.

Topics covered

This quiz

GRC Overview20 (12.5%)
Implementation Planning5 (3.1%)
Entity Framework31 (19.4%)
Policy and Compliance43 (26.9%)
Risk and Advanced Risk36 (22.5%)
Common Elements and Extended Capabilities16 (10%)
Audit and Advanced Audit9 (5.6%)

Exam blueprint

Official domain weights for this certification.

GRC Overview10%
Implementation Planning5%
Entity Scoping25%
Policy and Compliance Implementation Approach25%
Risk Implementation Approach25%
Extended Capabilities5%
Audit Management Implementation5%
GRC Overview20 questions
  • GRC Positioning and Framework4 q
  • Key Terminology4 q
  • Technical Details12 q
Implementation Planning5 questions
  • Use Cases2 q
  • Implementation Team and Checklist1 q
  • Risk and Compliance Personas, Groups and Roles2 q
Entity Framework31 questions
  • Entity Scoping Overview7 q
  • Entity Type Approach6 q
  • Entity Class Approach6 q
  • Entity Architecture12 q
Policy and Compliance43 questions
  • Policy and Compliance Record Lifecycles7 q
  • Policy and Compliance Architecture8 q
  • Policy and Compliance Configuration15 q
  • Compliance Supporting Processes13 q
Risk and Advanced Risk36 questions
  • Risk and Advanced Risk Record Lifecycles9 q
  • Risk and Advanced Risk Architecture10 q
  • Risk and Advanced Risk Configuration17 q
Common Elements and Extended Capabilities16 questions
  • Integrations6 q
  • Content Packs2 q
  • Other Platform Capabilities2 q
  • Regulatory Change Management2 q
  • Common Elements2 q
  • Continuous Monitoring2 q
Audit and Advanced Audit9 questions
  • Audit and Advanced Audit Lifecycles3 q
  • Audit and Advanced Audit Architecture3 q
  • Audit and Advanced Audit Personas, Groups, and Roles3 q

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

When planning a GRC implementation checklist, what should be true about activities?

Answer choices

  • A. Checklists are optional because GRC configures itself

  • B. Checklists should follow phased delivery: scope, entitlements, foundation data, application configuration, adoption, and operationalization

  • C. Only the Service Portal theme must be configured

  • D. Only hardware discovery must be completed first

Question 2

In which state of the Control record do Administrators schedule indicators?

Answer choices

  • A. Retired

  • B. Attest

  • C. Monitor

  • D. Review

Question 3

Indicator scheduled runs should align to which control lifecycle state?

Answer choices

  • A. Draft

  • B. Monitor

  • C. Retired only

  • D. Attest only

Question 4

How does ServiceNow release new versions of the ServiceNow Governance, Risk and Compliance (GRC) application?

Answer choices

  • A. Via the ServiceNow Store.

  • B. Via an application in ServiceNow Studio

  • C. Via ServiceNow family releases

  • D. Via unscoped Update Sets pushed between subproduction instances

Question 5

Which statement describes an Authority Document in ServiceNow Governance, Risk and Compliance (GRC)?

Answer choices

  • A. Authority Documents serve to monitor controls and risks, and collect audit evidence.

  • B. Authority Documents describe an internal practice that processes must follow.

  • C. Authority Documents manage processes and citations are created to manage the process.

  • D. Authority Documents are interchangeable with Knowledge article templates for HR policies