CIS Risk and Compliance (CIS-RC) Study Guide: IRM Blueprint, Key Topics and Study Plan

The ServiceNow Certified Implementation Specialist - Risk and Compliance (CIS-RC) exam validates your ability to implement Integrated Risk Management (IRM), which is ServiceNow's GRC solution. The exam is scenario-based: you need to understand how entities, policies, controls, risks, indicators and issues connect, not just what each record is called.

Focus on the three biggest domains (Policy and Compliance, Risk, and the Entity Framework) and make sure you can trace the full flow from an authority document to a remediated issue.

CIS-RC exam at a glance

Exam detail	Value
Questions	60 (multiple choice and multiple select)
Time	90 minutes
Passing score	Not published by ServiceNow
Official training	Risk and Compliance implementation training on ServiceNow University
Best preparation	Hands-on configuration of entities, policies, controls and risks

CIS-RC blueprint and domain weights

Domain	Approx. weight
Policy and Compliance	25%
Risk and Advanced Risk	25%
Entity Framework	20%
GRC Overview	12%
Common Elements and Extended Capabilities	8%
Implementation Planning	5%
Audit and Advanced Audit	5%

Confirm the current blueprint on ServiceNow University before booking.

The two flows you must know

Compliance flow: authority document, then citations, then policy statements (control objectives), then controls (one per entity in scope), then attestations and indicators, then issues and remediation.

Risk flow: risk framework, then risk statements, then risks (one per entity in scope), then assessments (from inherent to residual risk), then risk response and continuous monitoring.

Most scenario questions test a step in one of these two flows.

What to study in each domain

GRC Overview (12%)

• The IRM applications and how they work together (Policy and Compliance, Risk, Audit, Vendor Risk and more).
• Business drivers: regulations, frameworks and the value of an integrated approach.

Implementation Planning (5%)

• Typical implementation phases, stakeholders and data you need from the customer.
• Starting small (a few authority documents and entity types) and growing.

Entity Framework (20%)

• Entities, entity types (table + conditions that generate entities automatically) and entity classes.
• Entity hierarchies and how scope drives control and risk generation.
• Why entity design is the foundation of every IRM implementation.

Policy and Compliance (25%)

• Authority documents and citations (external regulations and their requirements).
• Policies and policy statements (control objectives), and how controls are generated per entity.
• Control attestations, policy exceptions and compliance scoring.
• Policy lifecycle: drafting, review, approval and publishing.

Risk and Advanced Risk (25%)

• Risk frameworks, risk statements and risk generation per entity.
• Inherent vs. residual risk, risk appetite and scoring.
• Risk assessments (including advanced risk assessment methodologies) and risk responses.
• Linking risks to controls.

Common Elements and Extended Capabilities (8%)

• Indicators for continuous monitoring (manual, basic, scripted, analytics-based).
• Issues and remediation tasks; dashboards and reporting.

Audit and Advanced Audit (5%)

• Audit engagements, activities and test plans, and how audit findings create issues.

Most common CIS-RC exam traps

1. Authority document vs. policy. One is an external regulation, the other an internal rule.
2. Controls and risks are generated, not created by hand, from the library for each entity in scope.
3. Entity type vs. entity class. Types generate entities from records; classes categorize them.
4. Inherent vs. residual. Residual risk is what remains after controls are considered.
5. Exceptions are not deletions. A temporary deviation is a policy exception. Deleting a control breaks the audit trail.

A 4-week CIS-RC study plan

Week	Focus
1	Official training; build entity types and an entity hierarchy on a Personal Developer Instance
2	Authority documents, citations, policies, policy statements, controls, attestations
3	Risk framework, risk statements, assessments, indicators and issues; first timed practice exam
4	Audit basics; review weak areas and documentation; 2-3 more timed practice exams

Check your readiness with 10 free CIS-RC sample questions. Every option is explained.

How hard is the CIS-RC exam?

CIS-RC is challenging for candidates who know GRC concepts but not the ServiceNow data model, and also for ServiceNow experts who have never implemented IRM. The exam expects both: the business process (policy, control, risk, issue) and the platform records that implement it.

If you can draw both flows above from memory and explain what generates what, you have covered the core of the exam.

Best CIS-RC study resources

• Official Risk and Compliance implementation training on ServiceNow University.
• A Personal Developer Instance with the IRM applications activated. Create entity types, a policy with statements and a risk framework.
• IRM product documentation for entity framework, policy and compliance, and risk.
• Timed practice exams with explanations for every option.

Related guides

Need the foundation first? Read the CSA study guide and our ServiceNow certification path overview.