Which role can you grant to external audit team members?

Which role can you grant to external audit team members?

• A. sn_compliance_user
• B. sn_audit.external_auditor
• C. sn_risk_user
• D. sn_audit_manager

Answer: (B)

This tests which role is intended for external audit team members in ServiceNow IRM. The best choice is the sn_audit.external_auditor role because it is specifically designed for third-party auditors and provides the necessary access to audit-related data while keeping editing and administrative capabilities restricted. This aligns with the principle of least privilege, giving external auditors visibility to audits, findings, and evidence without granting broader control over risk, compliance, or audit management. The other roles correspond to internal responsibilities: sn_compliance_user focuses on compliance-related tasks, sn_risk_user on risk management activities and configurations, and sn_audit_manager on managing audits and workflows. Granting those would give external auditors more permissions than needed and could raise security and separation-of-duties concerns.

This tests which role is intended for external audit team members in ServiceNow IRM. The best choice is the sn_audit.external_auditor role because it is specifically designed for third-party auditors and provides the necessary access to audit-related data while keeping editing and administrative capabilities restricted. This aligns with the principle of least privilege, giving external auditors visibility to audits, findings, and evidence without granting broader control over risk, compliance, or audit management.

The other roles correspond to internal responsibilities: sn_compliance_user focuses on compliance-related tasks, sn_risk_user on risk management activities and configurations, and sn_audit_manager on managing audits and workflows. Granting those would give external auditors more permissions than needed and could raise security and separation-of-duties concerns.