CIS-VRM Practice Questions

Vendor risk reports in ServiceNow are primarily generated from the core tables that store the essential data of the Vendor Risk Management (VRM) lifecycle. The Company [corecompany] table stores the vendor profiles, which is the foundation for all risk activities. The Vendor Risk Assessment [snvdrriskasmtassessment] table contains the records for each assessment, including its status, responses, and calculated risk scores. The Vendor Risk Issue [snvdrriskasmtissue] table tracks all issues identified during the assessment process that require remediation. Reporting on these three tables provides a comprehensive view of the vendor risk posture, assessment progress, and outstanding issues.

D. Vendor Contact [vmvendorcontact]: This table stores administrative contact information. While useful for communication, it is not a primary source for creating reports on vendor risk status or assessment outcomes.

E. Vendor Activity [vmvendoractivity]: This is not a standard, primary table used for substantive vendor risk reporting. Activities are typically tracked in journals or audit logs, not a dedicated reporting table of this name.

1. ServiceNow Product Documentation - Components installed with Vendor Risk Management: This document lists the key tables installed with the VRM application. It explicitly mentions snvdrriskasmtassessment (Vendor Risk Assessment) and snvdrriskasmtissue (Vendor Risk Issue) as core components. The corecompany table is the base for defining vendors.

Reference: ServiceNow Product Documentation, "Components installed with Vendor Risk Management," section "Tables."

2. ServiceNow Product Documentation - Vendor Risk Management dashboards and reports: The pre-configured dashboards and reports for VRM are built using these core tables. For example, the "Vendor Risk Overview" dashboard pulls data from vendors (corecompany), assessments (snvdrriskasmtassessment), and issues (snvdrriskasmtissue) to provide a holistic view.

Reference: ServiceNow Product Documentation, "Vendor Risk Management dashboards and reports," section "Vendor Risk Overview dashboard."

3. ServiceNow Product Documentation - Create a vendor: This guide confirms that vendors are stored in the Company [corecompany] table and are distinguished by the "Vendor" flag being set to true. This establishes it as the foundational table for any vendor-related reporting.

Reference: ServiceNow Product Documentation, "Create a vendor in Vendor Risk Management."

The Vendor Risk Assessor role (snvdrriskasmt.vendorassessor) is focused on the execution and review of vendor risk assessments. A primary function is to access and analyze the completed assessments submitted by vendors to evaluate their risk posture. If the assessor identifies any risks, control deficiencies, or non-compliant answers during their review, they are responsible for creating issues to track these findings through remediation. While a Vendor Manager typically manages the vendor profile, an assessor creating a new assessment may need to create a new vendor contact record if the appropriate individual to receive the questionnaire does not yet exist in the system.

A. Enable communications across vendors: This is not a function of a risk assessor. The VRM application manages relationships with individual vendors, not communication between them.

C. Update vendor contract deadlines: This is a contract management function, typically performed by a Vendor Manager or Contract Manager, not a risk assessor whose focus is on risk evaluation.

1. ServiceNow Product Documentation - Vendor Risk Management roles: The snvdrriskasmt.vendorassessor role is defined as having the capability to "create and update vendor risk assessments, issues, and tasks. Can view all vendor risk information." This directly supports the functions of accessing assessments (B) and creating issues (D).

Source: ServiceNow Product Documentation, "Vendor Risk Management roles," Rome release (and subsequent).

2. ServiceNow Product Documentation - Review and approve a vendor risk assessment: This document outlines the assessor's workflow, stating, "When the vendor submits the questionnaire... The vendor risk assessor can now review the vendor's responses... If the assessor finds a problem with an answer, they can create an issue, a task, or request more information." This confirms the assessor's responsibility to access completed assessments (B) and create issues (D).

Source: ServiceNow Product Documentation, "Review and approve a vendor risk assessment," Utah release (and subsequent).

3. ServiceNow Product Documentation - Create and send a vendor risk assessment: The procedure for creating an assessment requires selecting a "Vendor contact." For an assessor to fulfill their duty of creating an assessment, a contact must exist. If the necessary contact is missing, creating one (E) becomes a required supporting task to complete their primary function.

Source: ServiceNow Product Documentation, "Create and send a vendor risk assessment," Utah release (and subsequent).

In ServiceNow Vendor Risk Management (VRM), a Vendor Tiering Rule is the specific mechanism used to automate the assignment of a tier to a vendor. These rules process the responses from a completed Tiering Assessment, calculate a numerical score based on the answers, and then automatically assign the corresponding tier (e.g., Critical, High, Medium, Low) based on predefined score ranges. This ensures a consistent, repeatable, and automated process for classifying vendors according to their potential impact and risk to the organization.

A. A Risk Assessment: A Risk Assessment is used to evaluate a vendor's controls and inherent risks, which typically occurs after a tier has been assigned to scope the assessment.

B. A configuration setting: This is too generic. While a Vendor Tiering Rule is a type of configuration, it is the specific name of the feature that performs this function.

C. A Tiering Assessment: A Tiering Assessment is a questionnaire used to gather information for tiering. The rule processes this information; the assessment itself does not assign the tier.

E. A Visual Task Board: A Visual Task Board is a project and task management tool for visualizing and organizing work, unrelated to the logic of automatic field assignment.

1. ServiceNow Product Documentation - Vendor tiering rules: "Vendor tiering rules use the responses from a tiering assessment to calculate a score. Based on the score, a tier is automatically assigned to the vendor." This document explicitly details the function of Vendor Tiering Rules in automating the tier assignment process. (ServiceNow, Vendor Risk Management Documentation, "Vendor tiering rules").

2. ServiceNow Now Learning - Vendor Risk Management (VRM) Fundamentals: The courseware explains the vendor tiering process, stating that after a tiering assessment is completed, "the system uses vendor tiering rules to calculate a score and automatically assign a tier to the vendor." (ServiceNow, Now Learning, "Vendor Risk Management (VRM) Fundamentals", Module: Vendor Portfolio).

The System Administrator (admin) role is required for managing fundamental platform configurations. This includes creating, modifying, and selecting update sets, which are used to move customizations between instances. It also includes the ability to switch the application scope, ensuring that any configuration changes are correctly associated with the intended application, such as Vendor Risk Management. These are system-level functions that fall outside the scope of application-specific or user-management roles.

A. The Vendor Administrator role is specific to the VRM application and manages vendor data and assessments, not platform-level configurations.

B. The Data Administrator is not a standard, out-of-the-box ServiceNow role; its permissions would be custom and are not guaranteed.

C. The User Administrator role is focused on managing users, groups, and roles, and lacks the permissions to alter system configurations like update sets.

---

1. ServiceNow Product Documentation - Base system roles: The admin (System Administrator) role is described as having access to all system features, functions, and data. This inherently includes the ability to manage update sets and application scopes.

Reference: ServiceNow Product Documentation, Quebec Release, "Base system roles," section for "System administrator (admin)".

2. ServiceNow Product Documentation - Update Sets: The documentation explicitly states that administrative rights are required for managing update sets.

Reference: ServiceNow Product Documentation, Washington DC Release, "Update sets," section "Create an update set." The procedure notes that the admin role is required.

3. ServiceNow Product Documentation - Application Scope: The documentation on application scoping confirms that the admin role is necessary to switch between scopes.

Reference: ServiceNow Product Documentation, Washington DC Release, "Application scope," section "Select an application scope." It states, "To select an application scope, you must have the admin role or the delegateddeveloper role for that scope."

The primary advantage of integrating ServiceNow Vendor Risk Management (VRM) with Governance, Risk, and Compliance (GRC) or Integrated Risk Management (IRM) is the ability to create a holistic risk posture for vendors. When a control from the GRC/IRM application, which is associated with a vendor, becomes non-compliant, the system can automatically update the vendor's risk score in the VRM application. This ensures that compliance failures directly and dynamically contribute to the overall risk assessment of the vendor, providing a more accurate and up-to-date view of vendor-related risks.

A. Vendor Risk and Audit engagements are not automatically matched. While an audit finding can generate an issue that impacts a vendor's risk, there is no direct "matching" of engagement records.

B. The vendor risk manager sees controls relevant to specific vendors, not "all" compliance controls. Exposing all controls would be inefficient and irrelevant to the scope of vendor risk.

C. The vendor portal is for collaboration on assessments and issues. Primary contacts do not have visibility into the internal, aggregated non-compliant risk scores calculated within the GRC/IRM modules.

1. ServiceNow Product Documentation - Vendor Risk Management: In the section "Integration with GRC: Policy and Compliance Management," the documentation explicitly states, "When a control associated with a vendor is non-compliant, the risk rating of the vendor is automatically updated. Also, when an issue is created from a control, an audit engagement, or a compliance task, and the issue is related to a vendor, the risk rating of the vendor is automatically updated." This directly supports the correct answer (D).

2. ServiceNow Product Documentation - Vendor risk scoring: The documentation on vendor risk scoring explains that various factors contribute to the score. The integration with GRC allows "GRC-related information, such as control compliance or issues" to be one of these contributing factors, confirming that compliance status affects the score.

A Vendor Risk Issue is a record created within ServiceNow's Vendor Risk Management application to document and manage findings discovered during an assessment process. Its primary purposes are to track the lifecycle of these findings. This includes creating and monitoring remediation tasks to close identified compliance gaps or control deficiencies. Alternatively, if a business decision is made not to remediate, the issue record facilitates the formal process of documenting and approving the acceptance of the associated risk.

A. Log access-related incidents for the vendor portal: This is incorrect. Access-related incidents are typically managed through the Incident Management or Security Incident Response applications, not as GRC Vendor Risk Issues.

B. Indicate vendors that need further assessment: This is incorrect. The need for further, more detailed assessments is primarily determined by the vendor tiering assessment, which categorizes vendors based on their inherent risk.

1. ServiceNow Product Documentation - Issues in Vendor Risk Management: "Issues are created to document and track any findings that are discovered during the vendor risk assessment process. After an issue is created, you can assign it to an individual or group to be remediated. You can also request an exception or accept the risk." This statement directly supports both tracking remediation (D) and accepting risk (C).

Source: ServiceNow Product Documentation, "Vendor Risk Management," section on "Issues in Vendor Risk Management."

2. ServiceNow Product Documentation - Remediate a vendor risk issue: This document outlines the process where, "After an issue is reviewed and moved to the Analyze state, you can create remediation tasks to resolve the issue." This directly supports option (D) as a core purpose.

Source: ServiceNow Product Documentation, "Vendor Risk Management," section on "Remediate a vendor risk issue."

3. ServiceNow Product Documentation - Request an exception for a GRC issue: While part of the core GRC platform, this process is integral to VRM issue management. It states, "If you determine that it is not possible to bring a control into compliance... you can request an exception." This process, which includes risk acceptance, is managed through the issue record, supporting option (C).

Source: ServiceNow Product Documentation, "GRC: Issue Management," section on "Request an exception for a GRC issue."

In the ServiceNow Governance, Risk, and Compliance (GRC) framework, which encompasses Vendor Risk Management (VRM), the individual, reusable questions that comprise questionnaires and document requests are referred to as Metrics. These metrics are the fundamental building blocks used to gather evidence and assess a vendor's compliance and risk posture. A questionnaire template is constructed by grouping these metrics, often into categories, to form a complete assessment that can be sent to a vendor.

B. Ratings: Ratings are the scales or scores (e.g., 1-5, Compliant/Non-compliant) used to evaluate the answers provided for metrics, not the questions themselves.

C. Templates: Templates are pre-configured collections of metrics that form a complete questionnaire or document request, not the individual question units within them.

D. Tiers: Tiers are classifications assigned to vendors based on their inherent risk level (e.g., Strategic, High, Moderate), which is unrelated to questionnaire components.

1. ServiceNow Product Documentation: "Metric definition in GRC". This document states, "Metrics are qualitative or quantitative questions that are used to measure a process or function. Metrics are used in attestations and assessments to gather evidence and determine the level of risk or compliance." This directly identifies metrics as the questions.

2. ServiceNow Product Documentation: "Questionnaire templates in Vendor Risk Management". This guide explains the structure of assessments: "Questionnaire templates are composed of metric categories, which are in turn composed of metrics." This confirms the hierarchy where metrics are the base-level questions.

3. ServiceNow Now Learning: "Vendor Risk Management (VRM) Fundamentals" on-demand course. The "Assessments" module explicitly details the data model where Questionnaires are built from Templates, which contain Metric Categories and, finally, the individual Metrics (questions).

The status of a control is updated when the vendor formally submits their responses to the questionnaire. This action transitions the Vendor Risk Assessment's state to "Responses Received." Upon entering this state, the ServiceNow platform automatically triggers business rules that process the vendor's answers. These rules calculate the risk ratings and update the compliance status of any associated controls based on the provided responses. This allows the risk assessor to review the updated control status and proceed with the assessment, such as generating issues or finalizing the review.

B. This is incorrect because the "Finalizing with Vendor" and "Closed" states occur after the responses have been reviewed. The control status must be updated before this stage to inform the finalization process.

C. This is incorrect because simply saving a response does not trigger the update. The system waits for the formal submission of the entire assessment to process all answers cohesively.

D. This is incorrect because answering all questions is not the trigger. The vendor must explicitly submit the completed assessment, which changes its state and initiates the update process.

1. ServiceNow Product Documentation: Process a vendor risk assessment. In the section detailing the assessment workflow, it states, "When the vendor submits the questionnaire, the state of the assessment changes to Responses Received. The risk ratings are calculated, and the compliance of the controls is updated." This directly confirms that the "Responses Received" state is the trigger.

2. ServiceNow Product Documentation: Vendor Risk Assessment states. This document outlines the assessment lifecycle. The "Responses Received" state is defined as the point where the assessment is returned from the vendor and is ready for review by the assessor, implying that all calculations and updates based on vendor input have been completed.

In the baseline ServiceNow Vendor Risk Management (VRM) application, creating a functional Vendor Contact record requires three key pieces of information. First, the identity of the individual, captured through the First name and Last name fields. Second, the contact must be associated with a specific company, which is accomplished via the mandatory Vendor reference field. Finally, a valid Email address is required, as this is the primary method for sending assessments, issues, and other notifications through the platform. These fields are essential for the record to be uniquely identifiable, correctly associated, and actionable within VRM workflows.

C. Department: While useful for organizational context, the Department field is not a mandatory requirement for creating a vendor contact record in the baseline configuration.

E. Role: The Role field (e.g., Primary Contact) is important for defining the contact's responsibilities but is not a mandatory field upon initial record creation.

1. ServiceNow Product Documentation: The form for creating a new vendor contact explicitly marks specific fields as mandatory. The documentation for the "Create a vendor contact" procedure shows these required fields.

Source: ServiceNow Product Documentation, Washington DC Release, Vendor Risk Management, "Create a vendor contact".

Details: The procedure and associated form screenshots illustrate that "First name," "Last name," "Email," and "Vendor" are marked with a red asterisk, indicating they are mandatory fields out-of-the-box.

The snvdrriskasmt.vendorportalendpoint system property is used to define the URL endpoint for the vendor portal. Since the Paris release, the default value for this property is svdp, which directs users to the modern, scoped Service Portal-based vendor portal. To revert to the legacy, non-scoped portal for backward compatibility, an administrator must override this property and change its value to vdp. This single property controls which of the two portal experiences is presented to vendors.

A. snvdrriskasmt.vendorportal: This is not the correct system property name. The correct property includes endpoint to signify it controls the URL path.

B. snvdrriskasmt.scoped.vendorportalendpoint: This property name is incorrect. The inclusion of .scoped. does not align with the official property used for this purpose.

D. snvdrriskasmt.scoped.vendorportal: This is an invalid property name. It incorrectly includes .scoped. and omits the required endpoint suffix.

1. ServiceNow Product Documentation (Vancouver Release): Vendor Risk Management > Administration > Configure Vendor Risk Management > Vendor portal. The documentation states, "The legacy vendor portal is available for backward compatibility. To use the legacy portal, set the snvdrriskasmt.vendorportalendpoint system property to vdp."

2. ServiceNow Product Documentation (Utah Release): Vendor Risk Management > Reference > Properties installed with Vendor Risk Management. This page lists the property snvdrriskasmt.vendorportalendpoint with the description, "Specifies the vendor portal suffix. The default is svdp." This confirms it is the controlling property.