Guide: Setting up a simple policy attestation cycle in under a day.

While the marketing materials often speak in terms of "accelerated value realization," the reality for technical teams implementing ServiceNow GRC is that initial setup can be daunting. A common request from leadership is to demonstrate quick value, and a streamlined policy attestation cycle is an excellent candidate. Based on my team's recent implementation and subsequent benchmarking, I can confirm that a basic, automated attestation workflow can indeed be operational in under eight hours, provided you have a clear scope and admin access.

The critical success factor is strict scope limitation. For this guide, we will define a single policy, a defined group of attestors, a one-week attestation window, and a single reminder. We will not integrate with external HR systems for user sync, nor will we build complex escalation paths. The goal is a functioning, auditable cycle.

### Prerequisites & Configuration Outline

1. **Policy & Questionnaire Setup:** A single Policy record with a simple, binary-response questionnaire is the foundation.
2. **Attestor Population:** Manual population of the `Attestors` related list on the Policy, or use of a static group. Dynamic groups add time.
3. **Workflow Design:** A straightforward, schedule-triggered flow to generate tasks and send a reminder.

### Core Implementation Steps

**1. Policy & Questionnaire**
Create your Policy (`sn_grc_policy` table) and a related Questionnaire with one multiple-choice question (e.g., "I attest that I have read and understand this policy," with answers "Yes" and "No"). Link them.

**2. Manual Attestor Assignment**
For speed, directly add users to the `Attestors` related list on the Policy record. This bypasses the need for role or group configuration.

**3. Scheduled Job & Workflow**
The automation is driven by a scheduled job that triggers a workflow. The workflow's logic is simple:
- **Input:** Policy record.
- **Activity:** `Create Attestation Tasks` (Out-of-the-box Flow Action).
- **Wait for:** 4 business days.
- **Activity:** `Send Reminder Notification` (Custom notification activity).
- **Wait for:** 3 more business days.
- **Activity:** `Close Pending Tasks` (Optional, to auto-close outliers).

Here is the essential snippet for the reminder notification, which is often the only custom part. This would be placed in a "Script" activity within the workflow.

```javascript
// Workflow Script: Send Reminder for Pending Attestations
var policyGr = new GlideRecord('sn_grc_policy');
policyGr.get(workflow.scratchpad.policyId); // Assuming policy ID is stored

var taskGr = new GlideRecord('task');
taskGr.addQuery('parent', policyGr.sys_id);
taskGr.addQuery('sys_class_name', 'sn_grc_attestation_task');
taskGr.addQuery('state', '1'); // State 1 = "Open"
var recipients = [];
taskGr.query();
while (taskGr.next()) {
if (taskGr.assigned_to) {
recipients.push(taskGr.assigned_to.toString());
}
}

if (recipients.length > 0) {
var eventGr = new GlideRecord('sysevent');
eventGr.initialize();
eventGr.setValue('name', 'sn_grc.attestation.reminder');
eventGr.setValue('instance', policyGr.sys_id);
eventGr.setValue('parm1', recipients.join(',')); // Comma-separated user IDs
eventGr.insert();
}
```

**4. Notification Event & Email Template**
You must have an Event (`sysevent`) named `sn_grc.attestation.reminder` and a corresponding Email Template (`sys_email_template`). The template can be simple, containing the policy link and deadline.

### Benchmarks & Pitfalls

From our measured deployment:
- **Configuration Time:** ~4 hours (including testing).
- **Dry-Run Test Cycle:** ~2 hours.
- **Documentation & Handoff:** ~1 hour.

**Key Pitfalls to Avoid:**
- Do not over-engineer the questionnaire. Start with one question.
- Avoid dynamic group assignments for the first cycle; manual listing is faster.
- Ensure your scheduled job's timezone aligns with your business hours.
- The out-of-the-box "Create Attestation Tasks" action respects the attestation window defined on the Policy. Set it correctly.

This minimalist approach provides a fully automated attestation cycle, generating tasks, sending reminders, and compiling reports. It serves as a proven foundation upon which you can later build complexity (like escalations, integrations, or analytical dashboards) based on actual user feedback and process maturity. The tangible result is a completed, auditable attestation run that you can demonstrate to stakeholders within a single business day.

—chris