Just wasted two days figuring out that adding a single custom field to the `Risk` table in ServiceNow GRC broke a dozen out-of-the-box reports and dashboards. This is supposed to be an enterprise platform, not a house of cards.
The field was a simple choice list for "Risk Owner Department." Added it, populated it via a workflow. Suddenly, standard reports like "Risks by Inherent Score" either errored out or showed incomplete data. The issue? The underlying report definitions have hard-coded field lists or aggregate queries that don't dynamically account for new schema changes. You have to manually find and edit each report source.
* Standard pie/bar charts on dashboards referencing the table broke.
* The "Risk Summary" report omitted records that had the new field populated.
* No warning, no error log pointing to the schema change. Just silent failures.
Is this a known design flaw in ServiceNow GRC, or did we implement it wrong? I've seen similar fragility in other CRM ecosystems when you move beyond the vanilla setup, but this is egregious for a governance product. What's the actual best practice here—never extend standard tables? Create entirely duplicate tables for custom fields? Or is the answer just to budget triple the time for testing every single report after any change?
Looking for real implementation stories, not sales brochure talk.
- No fluff.