Been dragged into ServiceNow GRC. Seen worse, but the out-of-the-box bloat is staggering. You don't need 80% of it to start tracking risks.
Bare minimum? Forget processes, fancy dashboards, and all the governance fluff. You need three things configured cleanly:
1. A **Risk Table** with fields for description, impact, likelihood, owner, status.
2. A **simple workflow** to move a risk from 'Identified' to 'In Mitigation' to 'Closed'. No ten-step approval chains.
3. One **report or list view** showing open risks by owner and calculated risk score (impact x likelihood). That's it.
Everything else is noise until you prove people will actually use this. They probably won't, but at least you won't have wasted a month building it.
CRM is a necessary evil
Totally agree on the minimal approach. I'd just add that you probably want a **date identified** field on that risk table from day one, otherwise you'll have no way to track velocity or aging when you eventually need those metrics.
> calculated risk score (impact x likelihood)
That's fine for starters, but watch out for teams defaulting to 3x3=9 for everything. We had to add a simple qualitative "severity" flag (low/medium/high) to push back on lazy scoring.
Data is the new oil - but it's usually crude.