Industry Descriptor: National Passenger Rail and Critical Transportation Provider
The Challenge
This organization’s internal risk and compliance team needed to report on the status of findings from its Office of Inspector General audits, but many of those findings were tracked outside its risk platform. Without a single register, the team couldn’t reliably confirm that every finding had a corresponding issue, track remediation, or show leadership where things stood. Visibility into audits still in progress was limited, and the entity hierarchy needed updating to reflect how the organization actually operates.
The Solution
C1Secure made ServiceNow IRM the operational system of record for the program, starting with an active issue management register. The team took a progress-over-perfection approach, putting core workflows in place first and refining the register with the customer over time.
Key features of the implementation included:
- A Live Issue Register: Findings previously managed outside the platform were brought into IRM, and every new audit finding now gets a corresponding issue.
- Remediation and Exception Workflows: The team tracks, manages, and reports remediation efforts through structured issue and exception management workflows.
- Executive Dashboards and Trend Analysis: Leadership dashboards report on audit finding status, with trend analysis across findings and visibility into the audit engagement pipeline.
- An Updated Entity Model: The entity hierarchy was refreshed, with risk statements and compensating controls scoped to the right entities.
The Impact
- Every Finding Accounted For: Audit findings live in one register, each with an owner and a remediation path.
- Leadership-Ready Reporting: Executives see the status of audit findings and remediation in real time.
- Patterns, Not Just Findings: Trend analysis shows where issues recur so the team can address root causes.
- A Foundation to Build On: IRM is now the system of record the program can keep expanding on.
