How to Create a Scripted Indicator in ServiceNow GRC

As part of a GRC implementation, organisation ABC implements a set of controls that all need to be continuously monitored. The team uses indicators to track compliance for every control.

During implementation, the GRC team noticed that basic indicators are not sufficient to monitor all controls — particularly Control 123.

What's Special About Control 123?

To comply with Control 123, as a service owner, you must have fewer than 3 open critical incidents against your service. If the count reaches 3 or more, your control becomes non-compliant.

This condition is too complex for a basic indicator. We need a scripted indicator.

Implementing the Scripted Indicator

Here is what needs to be configured:

1. Set the indicator type to Script

2. Navigate to the Supporting tab and select the incident table as the source.

3. Add the supporting data field — this is the column that provides evidence of whether the indicator passed or failed.

4. Write the indicator script:

var offering = current.profile.applies_to.toString(); // Dot-walk to the service offering

var incArr = [];  // Will hold supporting evidence (incident sys_ids)
var isPassed = true; // Assume passing until proven otherwise

// Query all active critical incidents against this service offering
var incGr = new GlideRecord('incident');
incGr.addEncodedQuery('active=true^priority=1^service_offering=' + offering);
incGr.query();
while (incGr.next()) {
    incArr.push(incGr.sys_id + '');
}

// If 3 or more critical incidents found, the control fails
if (incArr.length >= 3) {
    isPassed = false;
}

result.value = 500;
result.passed = isPassed;
result.supportingDataIds = incArr;

Testing the Indicator

Hit Execute to test the indicator. Check the indicator status and indicator result. If there are 3 or more critical incidents against the service offering, you will see:

• Indicator Status: Failed
• Indicator Result: Contains the supporting evidence — the specific incidents linked as proof

This gives your GRC team a clear, auditable trail showing exactly why a control failed and which records support that conclusion.