Unified Controls in ServiceNow IRM for a Payroll and Earned-Wage Platform
537 requirements reduced to 126 controls in ServiceNow IRM, with 61% of control tests now running automatically.
Client name withheld by agreement- Client
- Payroll and earned-wage-access platform, 38,000 employer clients
- Region
- Stamford, Connecticut
- Year
- 2026 · Ongoing
- Duration
- 28 weeks
- Scope
- SOC 1, SOC 2, PCI DSS and state money-transmitter exams · ServiceNow IRM
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A payroll and earned-wage-access platform moves wages for 38,000 employer clients and lets their employees draw pay early to a debit card. It answers to SOC 1 auditors for payroll processing, SOC 2 auditors for its employer portal, a QSA for its card program and state examiners for its money-transmitter licenses.
Its ServiceNow instance ran IT service management well, but compliance lived in spreadsheets kept by three people. When two of them left in the same quarter, nobody could say with confidence which controls had been tested that year.
What we did
The approach, step by step.
- 01
One control library in IRM
We mapped 537 requirements from the four regimes into 126 controls in ServiceNow Integrated Risk Management, each with an owner, a test procedure and links to every requirement it satisfies.
- 02
Controls tied to the CMDB
Each control is attached to the business services and configuration items it protects, so scope follows the CMDB instead of a spreadsheet tab.
- 03
Tests that run themselves
Indicators pull configuration, access and change data from ServiceNow ITSM, the identity platform and the cloud provider, and raise an issue automatically when a control fails.
- 04
Audit requests answered in the platform
Auditors receive request lists and evidence through ServiceNow, and each evidence item is reused across every framework that needs it.
- 05
Delivered in two-week sprints
The program runs as an Agile backlog shared by the compliance and platform teams, releasing a working slice of the control library every sprint.
Outcomes
What changed, in numbers.
- 537
- requirements consolidated
- 126
- controls in ServiceNow IRM
- 61%
- of control tests automated
- 4
- audit regimes on one evidence library
We already lived in ServiceNow for IT. Putting compliance there was the first time both teams looked at the same data.
Related engagements
More work in Offensive Security & Resilience.
-
Edison, New Jersey · 6 weeks
Offensive Security & Resilience · 2025Online Ordering and Pickup Penetration Test for a Regional Grocery ChainA flaw that exposed any shopper’s order history and saved address, closed before the holiday ordering peak.
-
Albany, New York · 16 weeks
Offensive Security & Resilience · 2024Ransomware Resilience for a Gas and Electric Distribution UtilityIdentity, outage management and billing rebuilt from clean infrastructure in 19 hours during a full-scale exercise.
-
Hartford, Connecticut · 13 weeks
Offensive Security & Resilience · 2024Cyber Continuity and Enterprise Risk for a Mutual Property InsurerClaims kept moving through a simulated ransomware attack during a hurricane surge, and cyber risk now reports to the board against a stated appetite.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.