Risk Response tasks in ServiceNow IRM are governed by a workflow that drives their lifecycle. The workflow defines the states a task can move through—such as open, in progress, implemented, and closed—and the conditions or approvals that transition it from one state to the next. Because these transitions are encoded in the workflow, the system automatically progresses the Risk Response task through its states without requiring manual state changes. That automatic progression is what makes this statement true. Note that a risk can have more than one related Risk Response task, especially when multiple controls or remediation actions are tracked separately. Roles alone don’t rigidly restrict who can be assigned to a Risk Response task—the assignment is governed by the configured permissions and rules, not solely by a specific role like risk_manager or risk_admin.

Control objectives activate only when the parent policy is Published. Policies typically move through stages like Draft, Awaiting Approval, Published, and sometimes Review after updates. While a policy is in Draft or Awaiting Approval, it’s not in effect, so the control objectives attached to it aren’t active, and they don’t influence risk assessments or control testing. Publishing marks the policy as approved and current, enabling the associated control objectives to become active and guiding enforcement, evidence collection, and assurance activities. After publishing, any changes may trigger a new review or re-publish, but activation hinges on that Published state.

In GRC: Risk Management, certain tables act as the top-level containers for related artifacts, with other records linking to them as children. Item, Content, and Document function as these parent tables because they hold the primary objects that other IRM records reference or relate to. A Task, however, is used to represent work to be done on a specific item or content and is not itself a container for other IRM records. It’s typically a child record linked to a parent like an Item or Content rather than a parent of other records. So the Task table isn’t a parent table in the risk management data model. You can confirm by inspecting the table relationships in ServiceNow, where parent tables show child relationships and Task appears as a child under an Item or Content rather than hosting other IRM records.

When configuring an assessment scheduler for RAM, you scope which records to assess by selecting designated entity classes. RAM uses entity classes to group the kinds of items you want evaluated, so the scheduler will include only entities that belong to those classes. This targeted scope keeps the assessments relevant and manageable, rather than pulling in every active record or dimming the focus with unrelated data. The other options don’t fit because they either broaden the scope beyond what RAM is intended to assess (any active entity), relate to the content of a RAM rather than which items to assess (a published RAM), or are too generic and ignore the class-based organization RAM relies on (objects from ServiceNow tables).