A focused course, tailored for you
GRC in ITSM: From Ticket to Audit-Ready Evidence
A practical course for business analysts who need GRC controls to show up in ITSM workflows, not just in policy documents.
An ITSM ticket that closed the change request does not automatically prove the GRC control ran. Business analysts who own the GRC-ITSM integration live in that gap every audit cycle.
$199 one-time
Tailored to your situation. Access within 24 hours. 30-day money-back.
Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.
Why this course
Most ITSM platforms can record almost anything, but out-of-the-box GRC integration produces workflows that satisfy process owners and frustrate auditors. The change record shows approvals; it does not name the control, the risk register entry, or the exception threshold that determined who could approve. Audit prep becomes a manual reconciliation project: an analyst spending days pulling tickets and matching them to the GRC register, writing narrative summaries that explain what the system did not capture automatically. The course addresses the upstream cause: GRC requirements are not encoded into the ITSM workflow at design time, so the evidence is never there when it is needed.
The 12 modules
Module 1. Why ITSM Evidence Fails Audits
Examines the specific ways a well-run ITSM platform produces audit-incomplete records. Covers the structural difference between process compliance (did the ticket close correctly?) and control compliance (did the GRC control run and leave a retrievable record?). Reviews the three artefact gaps auditors cite most often: missing control reference, missing risk-tier justification, and missing exception log. Sets the baseline for what the rest of the course will fix.
Module 2. Reading a GRC Control Requirement as a Workflow Specification
Translates the language of GRC control documentation into the field-and-stage logic an ITSM configurator can act on. Works through a SOX IT-general-control example and an ISO 27001 change-management control side by side. Shows how to extract the mandatory evidence artefacts from the control text, identify which ITSM workflow stage produces each artefact, and flag control requirements that cannot be satisfied by ITSM alone.
Module 3. Designing Ticket Templates That Capture Control Evidence
Covers the field design decisions that determine whether a closed ticket is audit-usable or audit-incomplete. Explains mandatory versus conditional fields, the difference between free-text and structured-value capture for audit purposes, and why approver identity alone is insufficient without role-tier and threshold documentation. Includes a worked template for a change-management ticket that satisfies a two-framework audit requirement simultaneously.
Module 4. Linking the GRC Register to Live Tickets
Explains the integration architecture between a GRC risk and control register and an ITSM instance. Covers the three common integration models: reference-only (link by ID), read-sync (ITSM reads GRC threshold data at ticket creation), and write-back (ITSM pushes evidence records to GRC on closure). Identifies which model is appropriate for different audit frameworks and platform combinations, with configuration guidance for each.
Module 5. Encoding Risk Tiers and Approval Thresholds
Addresses how risk-tier logic from the GRC register should govern ITSM workflow routing. Covers configuring approval escalation paths that reflect the actual risk threshold in the control policy, not an approximation. Explains how to document the tier-to-workflow mapping so an auditor can trace an approval decision back to the GRC policy without interviewing the analyst. Includes a worked example covering high, medium, and low-risk change classifications.
Module 6. Exception Handling and the Audit-Visible Override Record
Focuses on the workflow path most likely to produce an audit finding: the approved exception. Covers how to design an exception workflow that captures the risk-acceptance rationale, the authorising role, the compensating control (if any), and the review date, all as structured fields rather than ticket comments. Explains why a comment-only exception record fails most framework audits and how to retrofit structured exception capture into an existing workflow.
Module 7. Incident and Problem Records as GRC Evidence
Extends the evidence framework from change management to incident and problem workflows. Covers which GRC controls typically rely on incident records as evidence (availability controls, response-time SLAs, root-cause documentation requirements) and how to configure incident ticket fields to satisfy those requirements. Includes a comparison of what a bare incident closure record shows versus what a GRC-configured closure record shows to an auditor.
Module 8. Building the Evidence Extraction Query
Teaches the analyst to build the query or report that pulls audit-period evidence from the ITSM platform in a form an auditor can read. Covers filtering by control reference, approval role, and date range; structuring the output to match the control's stated evidence requirement; and flagging records with incomplete fields before the auditor sees them. Walks through a complete extract for a SOC 2 availability control and an ISO 27001 change-control population.
Module 9. The Evidence Narrative: Writing the Analyst's Attestation
Covers the written summary the analyst provides alongside the raw ITSM extract. Explains what an auditor uses the narrative for (confirming methodology, understanding sampling scope, resolving ambiguous records) and what it does not need to contain. Provides a structured narrative template that covers population definition, exclusions, known exceptions, and control mapping, without requiring the analyst to write novel prose for each audit cycle.
Module 10. Handling Multi-Framework Audits from a Single ITSM Instance
Addresses the practical problem of a single ITSM workflow that must satisfy SOX, ISO 27001, and SOC 2 concurrently. Shows how to design ticket fields and workflow stages so each framework's evidence requirement is captured in the same record, which fields are framework-specific versus shared, and how to generate framework-specific evidence extracts from a single dataset. Covers the naming and tagging conventions that make multi-framework extraction reliable.
Module 11. Continuous Evidence Quality: Monitoring for Gaps Before Audit
Moves from audit-prep to continuous assurance. Covers building a scheduled report that identifies tickets closed with incomplete GRC fields, exception records missing required approvals, and integration-sync failures between the GRC register and the ITSM instance. Explains how to use this report as a weekly operational check rather than a pre-audit scramble, and how to assign remediation ownership within the ITSM workflow itself.
Module 12. Handing Off to the Auditor: Presentation and Walkthrough
Covers the final mile: preparing and delivering the evidence package to an internal or external auditor. Explains how to structure the handoff document so the auditor can navigate the extract, the narrative, and the system configuration evidence without a guided session. Includes guidance on responding to auditor requests for additional context without reopening the evidence extraction project from scratch, and on documenting the methodology for the next audit cycle.
How this addresses your situation
Specific modules that map to what you said you are dealing with.
Modules 1-3 address the design problem: why current ITSM configurations produce incomplete audit evidence and how to rebuild ticket templates that capture what is actually needed.
Modules 4-6 address the integration problem: connecting the GRC register to ITSM workflows so thresholds and exceptions are enforced and recorded at the point of action.
Modules 7-9 address the evidence-production problem: extracting, structuring, and narrating audit evidence from the ITSM system in a form an auditor can use independently.
Modules 10-12 address the operational sustainability problem: multi-framework coverage, continuous quality monitoring, and a repeatable handoff process that does not require the analyst to rebuild the evidence package from scratch each cycle.
Who it is for
Business analysts and GRC analysts who configure or support ITSM platforms, own the integration between a GRC tool and an ITSM system, and are accountable for audit-evidence quality during SOX, ISO 27001, SOC 2, or internal risk-review cycles. Typically works with one or two frameworks at a time but is responsible for making the evidence trail readable across all of them.
Who this is NOT for. Process improvement analysts with no GRC accountability. Platform developers who only need the technical API layer and do not interact with auditors or control owners. Compliance managers who read evidence but do not configure the systems that produce it.
How it arrives
Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.
Time investment. Twelve modules, designed for self-paced progress across two to three weeks. Each module is readable in a focused session; the templates are usable in the active ITSM environment from module three onward.
FAQ
Is this course specific to one ITSM platform?
The integration design principles and evidence-capture patterns apply across ITSM platforms. Worked examples use generic field structures. The implementation playbook is tailored to your specific configuration context.
What GRC frameworks does the course cover?
The course works through SOX IT-general-controls, ISO 27001 change management, and SOC 2 availability controls as concrete examples. The field-design and evidence-extraction principles apply to any framework that uses ITSM records as audit evidence.
Do I need to know the GRC platform's API?
No. The course covers integration at the configuration and workflow-design level. Technical API integration is addressed conceptually in module four; implementation detail is in the playbook for contexts where API access is available.
