Has anyone used the survey tool for control self-assessments? Feedback?

David R. · 2026-07-21T22:01:35Z

I've been evaluating the ServiceNow GRC survey tool for control self-assessments (CSAs) over the last two implementation cycles, and I have to say, my initial optimism has been replaced by significant frustration. The tool is serviceable for extremely basic, one-off questionnaires, but it falls apart under any real-world, scalable data collection scenario for a mature GRC program. It feels like a feature bolted onto the platform without serious consideration for how control testing and evidence collection actually work in an enterprise. My primary gripes are structural and data-centric: * **The data model is rigid and non-relational.** Survey responses are stored in a `task_survey` table, but linking a response to the specific control instance, framework, and assessment cycle often requires a convoluted web of `sys_id` references. Trying to run analytics on response rates, historical trends, or control performance over time requires a maze of joins that shouldn't be necessary. You essentially have to build your own reporting layer on top of it. * **Lack of true conditional logic.** You can do simple "show another question if answer is X," but you cannot implement complex branching required for real controls. For example, if a control has multiple parts (e.g., "Is the policy documented? Is it communicated annually?"), you cannot skip the evidence upload question for part B if part A was answered "No." This leads to noisy, incomplete data collection. * **Evidence handling is clunky.** The attachment mechanism is the standard ServiceNow attachment widget. There's no native integration to tie an evidence file directly to a specific control attribute or answer. You get a generic comment field and an attachment list. Auditors hate this because the audit trail from control -> question -> answer -> evidence file is not clean. * **No built-in support for automated testing.** A modern control self-assessment program needs to mix manual surveys with automated checks (e.g., "Is AWS CloudTrail enabled?"). The survey tool has zero capacity for this. You're forced to manually create a "survey" for an automated control, which is a conceptual mismatch and creates data inconsistency. If you're determined to use it, here is a bare minimum configuration checklist you must address before going live, based on hard lessons learned: ```javascript // Example of a scripted fix you'll likely need for reporting // This fetches survey responses with their related control info - a query not natively efficient. var gr = new GlideRecord('task_survey'); gr.addQuery('assessment_cycle', sysparm_cycle_id); gr.query(); while (gr.next()) { // You have to traverse to the control via the task/CI var controlId = gr.task.ci_item.sys_id; // This path is illustrative, often more complex var answer = gr.getValue('answer'); // Now join to other tables for framework, owner, etc. It's expensive. } ``` You will spend more time building workarounds for these limitations than you will using the core tool. My blunt recommendation: if your CSAs are more than a simple annual checkbox exercise, look at a specialized survey/product built for compliance (like RSA Archer, Lockpath, or even a well-designed Qualtrics setup with a tight ServiceNow integration via REST API). Use the ServiceNow tool only if you are locked into the platform for everything and have ample development resources to extend its basic functionality. For those who have used it, what has your experience been with the data extraction and reporting side? Have you found a sustainable way to model the response data for historical trend analysis, or did you also have to build a separate data mart? —davidr

Page 4 / 4 Prev

ServiceNow GRC Reviews

Last Post by ChrisM 27 minutes ago

47 Posts

45 Users

0 Reactions

13 Views

RSS

danielp

(@danielp)

Trusted Member

Joined: 2 weeks ago

Posts: 59

30/07/2026 8:55 am

Yep, completely nailed the conditional logic point. We tried to use it for a process with multiple approval layers and hit a wall.

You get the basic show/hide, but there's no way to branch into different *states* or assign tasks based on the answer. Like, if someone selects "Needs Review," you can't automatically create a Jira ticket for the compliance team. That means the survey isn't driving the workflow, it's just collecting data *for* a separate workflow. Defeats the purpose of having it inside a platform that's supposed to automate processes.

Ever found a decent hack for that, or did you just move the logic entirely into the business rules?

ReplyQuote

ChrisM

(@chrism)

Estimable Member

Joined: 2 weeks ago

Posts: 100

30/07/2026 9:34 am

Yeah, that Jira ticket example hits home. We tried triggering a ServiceNow incident from a survey answer using a business rule, and it sort of worked, but then you've broken the survey's audit trail. The ticket lives in a different table with a different sys_id, so good luck proving the lineage to an auditor later.

The real problem is > the survey isn't driving the workflow, it's just collecting data. Exactly. It's a data silo, not a process engine. We ended up moving all the real logic into a custom workflow outside the survey module, which basically meant we were using it as a dumb form front-end. Felt like a waste of the license.

K8s enthusiast

ReplyQuote

Page 4 / 4 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed