IRM ARCHITECT
INTERVIEWS.

How to answer

• Inherent risk = likelihood × impact, scored BEFORE controls are applied.
• Residual risk = inherent risk reduced by the effectiveness of mapped controls (sn_compliance_control).
• Target risk is the appetite the business will tolerate — set on the risk framework, not the risk record.
• Assessment templates (sn_risk_assessment_template) standardize the question set so scores are comparable across BUs.

Reference script

var risk = new GlideRecord('sn_risk_risk');
risk.get(riskSysId);
var inherent = risk.likelihood * risk.impact;
var ctrlAgg  = new GlideAggregate('sn_compliance_m2m_control_risk');
ctrlAgg.addQuery('risk', riskSysId);
ctrlAgg.addAggregate('AVG', 'control.effectiveness');
ctrlAgg.query();
ctrlAgg.next();
var eff = parseFloat(ctrlAgg.getAggregate('AVG','control.effectiveness')) || 0;
var residual = inherent * (1 - eff/100);
gs.info('inherent=' + inherent + ' residual=' + residual);

How to answer

• Attestation = a human asserts the control worked over a period; cheap to configure, weak as evidence.
• Continuous monitoring = an indicator (sn_grc_indicator) queries the source system on a schedule and writes a result.
• SOX IT general controls (access reviews, change management) belong in continuous monitoring — indicators on sys_user_group, change_request.
• Indicator templates make the script reusable across entities; the result populates issue records when thresholds break.

Reference script

// sn_grc_indicator script — orphan admin accounts
var gr = new GlideRecord('sys_user_has_role');
gr.addQuery('role.name', 'admin');
gr.addQuery('user.active', true);
gr.addQuery('user.last_login_time', '<', gs.daysAgo(90));
gr.query();
result = gr.getRowCount();   // indicator writes 'result'
// > 0 → automatic GRC issue under the mapped control

How to answer

• Profile types (sn_grc_profile_type) define WHAT is being assessed — Business Service, Vendor, Process, Application.
• Profiles (sn_grc_profile) are the instances — each row is one assessable entity, pointing at a profile type and a source table.
• Risks, controls, and issues attach to profiles, not directly to source records — that's the indirection that lets one risk apply to many entities.
• Vendor risk uses the sn_vdr_risk_asmt module which extends profile + assessment with tiering logic.

Reference script

// Create profile for a business service
var prof = new GlideRecord('sn_grc_profile');
prof.initialize();
prof.profile_type = businessServiceTypeSysId;
prof.table        = 'cmdb_ci_service';
prof.document     = serviceSysId;
prof.insert();
// Now risks/controls map to prof.sys_id, not the CI directly

How to answer

• Indicator breach → sn_grc_issue auto-created, linked to the failing control and profile.
• Issue routes to the control owner; remediation tasks (sn_grc_remediation_task) hold the actual work.
• Tasks can spawn change_request or incident records via Flow Designer for cross-module coordination.
• Issue closure requires evidence — attached doc or linked test result — before state can move to Closed/Resolved.

Reference script

// Flow Designer step: when issue.state = Closed
if (current.state == 3 && !current.evidence_attachment) {
  current.setAbortAction(true);
  gs.addErrorMessage('Attach evidence before closing.');
}