{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":17831,"path":"governance-risk-compliance/policy-and-compliance-management/r_InstallWPolAndCompl.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Components installed with Policy and Compliance Management\ndescription: Reference topics provide additional information about components that are installed with the activation of the Policy and Compliance Management plugin. These components include tables, user roles, and properties.Roles are added with activation of GRC: Policy and Compliance Management.Tables are added with activation of GRC: Policy and Compliance Management.The access control limitations \\(ACLs\\) or no role conditions with snc\\_internal role \\(or no role\\) is replaced with sn\\_grc.business\\_user role to control the access level of different users to compliance tables and also to track their usage.Properties are added with activation of GRC: Policy and Compliance Management.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/policy-and-compliance-management/r\\_InstallWPolAndCompl.html\nrelease: australia\nproduct: Policy and Compliance Management\nclassification: policy-and-compliance-management\ntopic_type: reference\nlast_updated: \"2026-03-12\"\nreading_time_minutes: 11\nbreadcrumb: [Policy and Compliance Management reference, Policy and Compliance Management, Governance, Risk, and Compliance]\n---\n\n# Components installed with Policy and Compliance Management\n\nReference topics provide additional information about components that are installed with the activation of the Policy and Compliance Management plugin. These components include tables, user roles, and properties.\n\n**Note:** The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/find-components.md).\n\nDemo data is available for this feature.\n\n**Parent Topic:**[Policy and Compliance Management reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/reference-data-policy-compliance.md)\n\n## Roles installed with GRC: Policy and Compliance Management\n\nRoles are added with activation of GRC: Policy and Compliance Management.\n\n<table id=\"table_adh_2dw_s3b\"><thead><tr><th>\n\nRole title \\[name\\]\n\n</th><th>\n\nDescription\n\n</th><th>\n\nContains roles\n\n</th></tr></thead><tbody><tr><td>\n\nCompliance Administrator\\[sn\\_compliance.admin\\]\n\n</td><td>\n\nContains the reader, user, manager, and admin roles in sn\\_grc scopes, and the reader, user, and manager roles in the Policy and Compliance Management application. In addition to the inherited permissions, the compliance admin can delete authority documents, citations, policies, control objectives, and controls.\n\n</td><td>\n\n-   sn\\_compliance.manager\n-   sn\\_grc.admin\n\n</td></tr><tr><td>\n\nAttestation Creatorsn\\_compliance.attestation\\_creator\n\n</td><td>\n\nRole used for creating the GRC attestation metric type, as well as exception questionnaires.\n\n</td><td>\n\nassessment\\_admin\n\n</td></tr><tr><td>\n\nCompliance Developer\\[sn\\_compliance.developer\\]\n\n</td><td>\n\nContains the reader, user, manager, admin, and developer roles in sn\\_grc scopes, and the reader, user, manager, and admin roles in the Policy and Compliance Management application. In addition to the inherited permissions, the compliance developer can create article templates and edit scripts.\n\n</td><td>\n\n-   sn\\_compliance.admin\n-   sn\\_grc.developer\n\n</td></tr><tr><td>\n\nCompliance Manager\\[sn\\_compliance.manager\\]\n\n</td><td>\n\nContains the reader, user, and manager roles in sn\\_grc scopes, and the reader and user roles in the Policy and Compliance Management application. In addition to the inherited permissions, the compliance manager can create authority documents, citations, control objectives, and controls.\n\n</td><td>\n\n-   sn\\_compliance.user\n-   sn\\_grc.manager\n-   sn\\_vdr\\_risk\\_asmt.vendor\\_assessment\\_reviewer\n\n</td></tr><tr><td>\n\nCompliance Reader\\[sn\\_compliance.reader\\]\n\n</td><td>\n\nContains the reader role in sn\\_grc scopes. In addition to the inherited permissions, the compliance reader can be assigned indicators templates, indicators, and issues.\n\n</td><td>\n\n-   sn\\_grc.reader\n-   survey\\_reader\n\n</td></tr><tr><td>\n\nCompliance User\\[sn\\_compliance.user\\]\n\n</td><td>\n\nContains the reader and user roles in sn\\_grc scopes, and the reader role in the Policy and Compliance Management application. In addition to the inherited permissions, the compliance user can be assigned controls and create policies, and has read-only access to the Risk Management application and modules. The compliance user can also create control objectives.\n\n</td><td>\n\n-   sn\\_compliance.reader\n-   sn\\_grc.user\n-   sn\\_risk.reader\n-   survey\\_reader\n-   vendor\\_reader\n\n</td></tr><tr><td>\n\nCorporate compliance analyst \\[sn\\_compliance\\_ws.corporate\\_compliance\\_analyst\\]\n\n</td><td>\n\nContains the reader and user roles in sn\\_grc scopes, and the reader role in the Compliance Workspace.\n\n</td><td>\n\n-   sn\\_compliance.user\n-   sn\\_audit.user\n\n</td></tr><tr><td>\n\nCorporate compliance manager \\[sn\\_compliance\\_ws.corporate\\_compliance\\_manager\\]\n\n</td><td>\n\nContains the reader, user, and manager roles in sn\\_grc scopes, and the reader and user roles in the Compliance Workspace.\n\n</td><td>\n\n-   sn\\_compliance.manager\n-   sn\\_compliance\\_ws.corporate\\_compliance\\_analyst\n-   sn\\_audit.manager\n\n</td></tr><tr><td>\n\nIT compliance manager \\[sn\\_compliance\\_ws.it\\_compliance\\_manager\\]\n\n</td><td>\n\nContains the reader, user, and manager roles in sn\\_grc scopes, and the reader and user roles in the Compliance Workspace.\n\n</td><td>\n\n-   sn\\_compliance.manager\n-   sn\\_audit.manager\n\n</td></tr></tbody>\n</table>## Tables installed with Policy and Compliance Management\n\nTables are added with activation of GRC: Policy and Compliance Management.\n\n<table id=\"table_qlq_g3m_vs\"><thead><tr><th>\n\nTable\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nAuthority Document\\[sn\\_compliance\\_authority\\_document\\]\n\n</td><td>\n\nExtends the Document \\[sn\\_grc\\_document\\] table and stores all Authority Documents.\n\n</td></tr><tr><td>\n\nControl\\[sn\\_compliance\\_control\\]\n\n</td><td>\n\nExtends the Item \\[sn\\_grc\\_item\\] table and stores all controls.\n\n</td></tr><tr><td>\n\nPolicy\\[sn\\_compliance\\_policy\\]\n\n</td><td>\n\nExtends the Document \\[sn\\_grc\\_document\\] table and stores all policies.\n\n</td></tr><tr><td>\n\nArticle Template\\[sn\\_compliance\\_article\\_template\\]\n\n</td><td>\n\nUsed to format the policy text contained in a policy record when publishing the policy to the knowledge base \\(KB\\).\n\n</td></tr><tr><td>\n\nCitation\\[sn\\_compliance\\_citation\\]\n\n</td><td>\n\nExtends the Content \\[sn\\_grc\\_content\\] table and stores all citations.\n\n</td></tr><tr><td>\n\nPolicy exception risk rating mapping \\[sn\\_compliance\\_policy\\_exception\\_risk\\_rating\\_mapping\\]\n\n</td><td>\n\nStores the mapping details of the risk assessment rating with the policy exception risk rating.\n\n</td></tr><tr><td>\n\nPolicy to Entity Type\\[sn\\_compliance\\_m2m\\_policy\\_profile\\_type\\]\n\n</td><td>\n\nExtends Document to Entity Type \\[sn\\_grc\\_m2m\\_document\\_profile\\_type\\] and is a many-to-many relationship table that is used to manage the relationships between policies and entity types.\n\n</td></tr><tr><td>\n\nControl Objective to Citation\\[sn\\_compliance\\_m2m\\_statement\\_citation\\]\n\n</td><td>\n\nMany-to-many relationship table that is used to manage relationships between control objectives and their related citations.\n\n</td></tr><tr><td>\n\nControl Objective to Entity Type\\[sn\\_compliance\\_m2m\\_statement\\_profile\\_type\\]\n\n</td><td>\n\nExtends Content to Entity Type \\[sn\\_grc\\_m2m\\_content\\_profile\\_type\\] and is a many-to-many relationship table that is used to manage the relationships between control objectives and entity type.\n\n</td></tr><tr><td>\n\nControl objective\\[sn\\_compliance\\_policy\\_statement\\]\n\n</td><td>\n\nExtends the Content \\[sn\\_grc\\_content\\] table and stores all control objectives.\n\n</td></tr><tr><td>\n\nControl objective requirement\\[sn\\_compliance\\_policy\\_stmt\\_requirement\\]\n\n</td><td>\n\nStores the requirement number and the requirement description of a control objective requirement.\n\n</td></tr><tr><td>\n\nControl objective to Control objective requirement\\[sn\\_compliance\\_m2m\\_policy\\_stmt\\_policy\\_stmt\\_rqmt\\]\n\n</td><td>\n\nMany-to-many relationship table that is used to manage relationships between control objective and control objective requirement.\n\n</td></tr><tr><td>\n\nControl requirement\\[sn\\_compliance\\_control\\_requirement\\]\n\n</td><td>\n\nStores the requirement number of control\n\n</td></tr><tr><td>\n\nControl to Control requirement\\[sn\\_compliance\\_m2m\\_control\\_control\\_requirement\\]\n\n</td><td>\n\nMany-to-many relationship table that stores the control and control requirement details. The **Implementation status** field gives the information whether the requirement is inherited or self implemented.\n\n</td></tr><tr><td>\n\nRequirement selection\\[sn\\_compliance\\_hybrid\\_selection\\]\n\n</td><td>\n\nStores the selections of control requirements. It contains the details of control requirements, control objective, entity, and authorization package.\n\n</td></tr><tr><td>\n\nPolicy exception\\[sn\\_compliance\\_policy\\_exception\\]\n\n</td><td>\n\nStores all policy exceptions.\n\n</td></tr><tr><td>\n\nPolicy to Policy Statement\\[sn\\_compliance\\_m2m\\_policy\\_policy\\_statement\\]\n\n</td><td>\n\nMany-to-many relationship table that is used to manage relationships between policy and control objectives.\n\n</td></tr><tr><td>\n\nControl to entity \\[sn\\_compliance\\_m2m\\_control\\_entity\\]\n\n</td><td>\n\nExtends Item to entity \\[sn\\_grc\\_m2m\\_entity\\_item\\] table.\n\n</td></tr></tbody>\n</table>**Note:** All additional tables installed by the dependent plugins are also needed for Policy and Compliance Management.\n\n## Access limitations for GRC business user role\n\nThe access control limitations \\(ACLs\\) or no role conditions with snc\\_internal role \\(or no role\\) is replaced with sn\\_grc.business\\_user role to control the access level of different users to compliance tables and also to track their usage.\n\n-   **GRC business user \\(sn\\_grc.business\\_user\\) role**\n\n    GRC business user role is granted to users who could perform any GRC operations. It is also granted to users with snc\\_internal role who have performed all operations like creating policy exception, issues, and responding to attestations, acknowledgements, and other operations. This role comes with installing GRC Profiles plugin.\n\n-   **GRC business user – lite \\(sn\\_grc.business\\_user\\_lite\\) role**\n\n    Users who could do limited operations with snc\\_internal role are considered as lite operators. Such users are given the GRC business user – lite \\(sn\\_grc.business\\_user\\_lite\\) role so as to track the lite usage of compliance tables using the role. This role is granted through explicit roles plugin, GRC: Business User – Lite, which can be installed by users with maint access or ServiceNow support teams.\n\n\nFor more information on install, upgrade, and role assignments, see [GRC Business User Role \\[KB0864247\\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB0864247) article in the Now Support Knowledge Base.\n\n**Note:** You must log in to Now Support to view the articles.\n\nThe access limitations of users with GRC business user role and other roles for different compliance tables and other related tables are listed herewith. For more information, see the [Security tightenings for GRC: Policy and Compliance Management \\[KB1112315\\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB1112315) article in the Now Support Knowledge Base.\n\n-   **Control Objective**\n    -   Users with GRC business user or business user lite role can read all control objectives.\n    -   If GRC: Audit Management application is installed and the control objective has a published policy associated to it, then users with external auditor role can read such control objectives.\n    -   Users with business user lite have read access to report an issue or policy exception.\n-   **Policy**\n    -   Users with GRC business user or business user lite role can read all policies.\n    -   If GRC: Audit Management application is installed, users with external auditor role can read all published policies.\n    -   Users with business user lite have read access to policies so as to create policy exceptions.\n-   **Policy to Control Objective M2M**\n    -   Users with GRC business user or business user lite role can read a policy to control objective M2M record.\n    -   If GRC: Audit Management application is installed, users with external auditor role can read a policy to control objective M2M record if the policy is published.\n-   **Control \\[sn\\_compliance\\_control\\]**\n    -   Users with GRC business user or business user lite role can view a control.\n    -   If GRC: Audit Management application is installed, users with external auditor role can read a control.\n-   **Assessment Instance \\[asmt\\_assessment\\_instance\\]**\n    -   Users with GRC business user and business user lite role can view attestations that are assigned to them.\n    -   ServiceNow users with GRC business user or business user lite role can take assessments.\n    -   Users with GRC business user or business user lite role can view My Grouped Attestations module.\n    -   Users with GRC business user and business user lite role can view Group Assessment UI and Ungroup Assessment UI actions.\n    -   Users with GRC business user and business user lite role can view **My Attestations** option in GRC application menu.\n-   **Assessment Metric Type \\[asmt\\_metric\\_type\\]**\n\n    User role is set to GRC business user or business user lite if the evaluation is attestation, the table is Policy Exception, and the role is empty.\n\n-   **Control Overview report**\n\n    User with GRC reader role can view the control overview report.\n\n-   **Issue \\[sn\\_grc\\_issue\\]**\n    -   **Report and View issues in Service Portal**\n\n        Users with GRC business user role can report an issue and view their reported issues in Service Portal. GRC business user is the minimum role required to view **My Issues** in the Service Portal.\n\n    -   **Read**\n\n        Users with the following roles can view an issue:\n\n        -   GRC user \\(sn\\_grc.user\\) role\n        -   GRC business user or business user lite role. Furthermore, the user must fulfil any one of the following conditions:\n            -   **Assigned to** field in the issue is the user.\n            -   **Assigned to** of the parent issue is the user or **Assignment group** of the parent issue is one of the user's groups.\n            -   **Assignment group** is one of the user's groups. Additionally, the user must also have the GRC business user role.\n            -   **Issue manager** is the user.\n            -   **Issue manager group** is one of the groups that belong to the logged in user.\n            -   **Control/Risk** of the issue has an owner and the owner is the user.\n            -   Issue is created by the logged in user.\n            -   Issue is created out of an issue triage opened by the user.\n            -   Logged in user is the assignee or watchlist user on a remediation task for the issue.\n            -   If GRC: Audit Management is installed, you are an external auditor only; and an auditor on a closed engagement that had control test issues or other issues, can view only those issues.\n    -   **Write**\n\n        If the user with the business user role is also the user designated in the **Assigned to** field, then the user can edit:\n\n        -   Name\n        -   Description\n        -   Issue manager\n        -   Issue manager group\n        -   Action plan\n        -   State\n        -   Parent issue\n        -   Additional comments\n        -   Work notes\n        -   Response\n        -   Explanation\n        If the user with the business user lite role is also the user designated in the **Assigned to** field, then the user can edit:\n\n        -   Issue manager\n        -   Issue manager group\n        -   State\n        -   Parent issue\n        -   Additional comments\n        -   Work notes\n        -   Response\n        -   Explanation\n        **Note:** If users with business user and business user lite roles have reported an issue, then they can add comments to the issue. However, a GRC user can edit all issues.\n\n    -   **View My Open Issues**\n\n        Users with a minimum role of a GRC business user or business user lite can view their open issues.\n\n    -   **Issue grouping**\n\n        Issue grouping is only open to users with GRC user role.\n\n    -   **Send information**\n\n        A minimum of GRC business user or business user lite role is required to send information for the issue.\n\n-   **Issue Source \\[sn\\_grc\\_issue\\_source\\]**\n\n    A minimum of GRC business user role is required to view and edit the Issue Source table.\n\n-   **Remediation task \\[sn\\_grc\\_task\\]**\n    -   User in the **Assigned to** field of the Remediation task table must have a minimum of GRC business user or business user lite role.\n    -   For read access, users who have a remediation task assigned to them or who are the watchlist users on the remediation task must have a GRC business user or business user lite role. The **Assigned to** user of the issue, the issue manager of the issue, or any user with GRC manager \\(sn\\_grc.manager\\) role can view a remediation task.\n    -   **My Open Remediation Tasks** is visible to users with a minimum role of GRC business user or business user lite.\n-   **My Indicator Task \\[sn\\_grc\\_indicator\\_task\\]**\n\n    Users with GRC business user or business user lite role can access My Indicator Tasks.\n\n-   **Policy Acknowledgement**\n\n    Users with GRC business user or business user lite role can:\n\n    -   Acknowledge policies from ServiceNow AI Platform UI and Service Portal.\n    -   View **My Acknowledgements** menu option in Service Portal.\n    -   View Acknowledgement instances \\[sn\\_compliance\\_policy\\_acknowledgement\\_instance\\] that are assigned to them.\n-   **Policy Exception \\[sn\\_compliance\\_policy\\_exception\\]**\n\n    Users with GRC business user or business user lite role can:\n\n    -   Raise Policy Exceptions from ServiceNow AI Platform and Service Portal.\n    -   View policy exception. Users with read access include users who requested policy exception, are present in watch list, and are verification approvers, final approvers, impacted control owners, and compliance managers.\n\nFor more information, see:\n\n-   [GRC Business user role \\[KB0864247\\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB0864247) article in the Now Support Knowledge Base.\n-   [Governance, Risk, and Compliance License Compliance update \\[KB1096178\\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB1096178) article in the Now Support Knowledge Base.\n\n## Properties installed with GRC: Policy and Compliance Management\n\nProperties are added with activation of GRC: Policy and Compliance Management.\n\n<table id=\"table_ght_bmm_vs\"><thead><tr><th>\n\nName\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nEntity hierarchy based scoringsn\\_compliance.entity\\_hierarchy\\_based\\_scoring\n\n</td><td>\n\n-   **Type**: true or false\n-   **Default value**: false\n-   **Location**: **All** &gt; **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr><td>\n\nTrigger control attestations based on the created or updated date of the last completed attestation sn\\_compliance.attestation\\_run\\_reference\\_date\\_field\n\n</td><td>\n\n-   **Type**: string\n-   **Default value**: Created date, Updated date\n-   **Location**: **All** &gt; **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr><td>\n\nStates for which the control is active \\(the first state is the default active state\\)sn\\_compliance.active\\_states\n\n</td><td>\n\nCompliance administrators can change this setting.-   **Type**: string\n-   **Default value**: draft, assess, review, monitor\n-   **Location**: **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr><td>\n\nStates for which control is inactive \\(the first state is the default inactive\\)sn\\_compliance.closed\\_states\n\n</td><td>\n\nCompliance administrators can change this setting.-   **Type**: string\n-   **Default value**: retired\n-   **Location**: **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr><td>\n\nName of the assessment metric type that is used for attestationssn\\_compliance.default\\_attestation\n\n</td><td>\n\nSystem administrators can change this setting.-   **Type**: string\n-   **Default value**: GRC Attestation\n-   **Location**: **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr><td>\n\nsn\\_compliance.glide.script.block.client.globals\n\n</td><td>\n\n-   **Type**: true or false\n-   **Default value**: false\n-   **Location**: **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr><td>\n\nName of the knowledge base used to publish Policy articlessn\\_compliance.knowledge\\_base\n\n</td><td>\n\nCompliance administrators can change this setting.-   **Type**: string\n-   **Default value**: Governance, Risk, and Compliance\n-   **Location**: **Policy and Compliance** &gt; **Administration** &gt; **Properties**\n\n</td></tr><tr id=\"smart-assessment\"><td>\n\nEnable smart assessments on controlsn\\_compliance.enable\\_smart\\_assessments\n\n</td><td>\n\nProperty that enables the assessment of controls using the non-classic assessment engine.-   Type: true or false\n-   Default value: false\n\n</td></tr></tbody>\n</table>"}}