What is the advantage of using both VRM and GRC/IRM?

The primary advantage of integrating ServiceNow Vendor Risk Management (VRM) with Governance, Risk, and Compliance (GRC) or Integrated Risk Management (IRM) is the ability to create a holistic risk posture for vendors. When a control from the GRC/IRM application, which is associated with a vendor, becomes non-compliant, the system can automatically update the vendor's risk score in the VRM application. This ensures that compliance failures directly and dynamically contribute to the overall risk assessment of the vendor, providing a more accurate and up-to-date view of vendor-related risks.

A. Vendor Risk and Audit engagements are not automatically matched. While an audit finding can generate an issue that impacts a vendor's risk, there is no direct "matching" of engagement records.

B. The vendor risk manager sees controls relevant to specific vendors, not "all" compliance controls. Exposing all controls would be inefficient and irrelevant to the scope of vendor risk.

C. The vendor portal is for collaboration on assessments and issues. Primary contacts do not have visibility into the internal, aggregated non-compliant risk scores calculated within the GRC/IRM modules.

1. ServiceNow Product Documentation - Vendor Risk Management: In the section "Integration with GRC: Policy and Compliance Management," the documentation explicitly states, "When a control associated with a vendor is non-compliant, the risk rating of the vendor is automatically updated. Also, when an issue is created from a control, an audit engagement, or a compliance task, and the issue is related to a vendor, the risk rating of the vendor is automatically updated." This directly supports the correct answer (D).

2. ServiceNow Product Documentation - Vendor risk scoring: The documentation on vendor risk scoring explains that various factors contribute to the score. The integration with GRC allows "GRC-related information, such as control compliance or issues" to be one of these contributing factors, confirming that compliance status affects the score.