ServiceNow Attestation Explained

What Attestation Is and Why It Matters

Attestation is a formal confirmation by a person in authority that data or a configuration is accurate and compliant. In ServiceNow, attestation is built into workflows so that owners periodically certify records. For example, an IT manager attests that the hardware inventory list she oversees is correct, or a database administrator attests that user access permissions in a critical system have been reviewed and are appropriate. Attestation creates an audit trail showing who confirmed what, when, and provides evidence that governance controls are operating.

Without attestation, you have data but no proof it was recently reviewed. With attestation, you can show auditors that access controls are checked quarterly, that inventory is verified regularly and that configuration changes have been reviewed by qualified staff.

Where Attestation Lives in the Platform

Attestation in ServiceNow is managed through the Attestation application, available depending on your release and licensing. Common modules that use attestation include Access Governance for user entitlements, CMDB for configuration accuracy and Vendor Risk Management for third-party controls. An attestation workflow defines who must attest, what they are attesting to and how often. For example, you might set up an annual attestation where each department manager confirms their team’s access permissions are still appropriate.

When an attestation is due, the system sends notifications to the designated attester. They receive a list of records requiring attestation, review each and either confirm it is accurate or flag it for investigation. Completed attestations are recorded as a snapshot showing what was confirmed on which date.

A Worked Example: Department Access Attestation

Consider a scenario where your Compliance team needs departments to attest to user access in a financial system twice a year. You set up an attestation schedule to run in June and December. The system queries the access table for all active users in each department. It generates an attestation task for each department manager, listing the users with access and the permissions they hold.

The manager reviews the list. Bob was transferred to another team in September, so Bob should not have access. The manager marks Bob’s access as non-compliant. Sarah is in the department and works with the system daily, so the manager attests that Sarah’s access is appropriate. The system records the manager’s confirmation and flags Bob’s access for removal by IT. After IT removes Bob, the next audit can show that the access issue was identified through attestation and remediated within a defined timeframe.

Setting Up Attestation Workflows

To configure attestation, define the policy that governs it. Specify which records require attestation, who must attest to them and how often. Set conditions: for example, attest only to users in the Finance department, or only to changes made in the last 90 days. Define what data the attester sees. Attestation often shows only the essential facts: user name, access granted, date of last change. Unnecessary details distract and slow the review.

Set consequence rules for non-response. If an attestation is due and not completed within a week, send a reminder. After two weeks, escalate to the manager’s supervisor. These rules ensure attestations do not sit pending indefinitely. Also define the outcome: if an attester marks something non-compliant, which team investigates and remediates it.

Common Misunderstandings

Attestation is not a substitute for automated controls. Attestation depends on the attester reading and thinking. If they are rushed, they might rubber-stamp everything without real review. Pair attestation with automated controls: alerts that flag unusual access patterns, workflow rules that expire old access automatically, and configuration scans that detect unauthorised changes. Attestation confirms that a qualified human has reviewed, but automated rules catch most problems before human review is needed.

Attestation is not one-time. A single attestation shows you reviewed something once. Real governance is continuous. Schedule attestations regularly: annually for stable data, quarterly for volatile data, weekly for critical systems. One certification three years ago proves nothing about compliance today.

Related Concepts and Governance Lifecycle

Certification is related to attestation but broader: you might certify that an entire system meets a standard, while attestation confirms individual records. Recertification is planned re-attestation at scheduled intervals. Compliance workflows integrate attestation with remediation: if an attester flags non-compliance, a task is created to investigate and resolve it. Audit trails of attestations serve as evidence for compliance auditors that your governance controls are operating and have been effective.

Deciding what an attester is really confirming

An attestation campaign often fails at the first step, when nobody has defined what the attester is actually signing. A manager who receives a list of forty user names with permission sets will either skim it or spend an afternoon guessing. The reviewer needs a single statement they can judge, such as “these people still need this access for their current job”, and the list must show the facts that test that statement: the role, the last time the access was used or changed, and whether the person has changed team since the last review.

Before building anything, agree with the control owner which population the campaign covers, which evidence each attester must see, and what counts as a valid answer. “Approved”, “remove”, and “unsure with an owner named to investigate” are often enough. A fourth vague option, such as “review later”, should be removed because it creates records that look completed but are not.

Choosing the scope of each campaign

Attestation can be organized around the person being reviewed, the application being reviewed, or the item that holds the data. Each choice answers a different audit question, and mixing them in one campaign makes the evidence hard to read.

Scope	Question it answers	Typical attester	Typical weakness
Per user across systems	Does this person still need everything they hold?	Line manager	Managers rarely know system-level permissions
Per application or role	Who holds this privileged role, and should they?	Application owner	Owners may not know every individual by name
Per configuration item	Is this record accurate and supported?	Service or asset owner	Records outnumber people, so reviews get rushed

For a first campaign, the application owner scope often gives the cleanest result, because privileged roles are fewer and their owners can explain why each holder needs the role. Move to per-user review once the privileged population is under control.

Running a campaign from scoping to remediation

Treat the campaign as a controlled process with named steps. Skipping the last step is a common reason an audit finds a completed attestation with no visible result.

1. Freeze the population at a stated point in time and record that date with the campaign.
2. Remove records the attester cannot judge, such as accounts with no owner, and log them as separate exceptions.
3. Assign each attester a route for questions, so unclear items reach a person who can investigate rather than a generic inbox.
4. Require a written reason for every rejection and every unsure answer.
5. Open a remediation task for each rejected item, with an owner and a closure check.
6. Close the campaign only when every remediation task is either complete or formally accepted as a risk by someone with authority to accept it.

Keep the separation of duties in mind. A person should never attest to their own access, and an administrator who removes access should not be the only person who confirms the removal worked. Where the attester and the requester are the same individual, route the decision to their manager.

Warning signs that the campaign is not doing its job

• Completion rates look high but almost every answer is approval, with no rejections in several cycles. That often means reviewers are rubber-stamping, not that access is clean.
• Rejected items reappear in the next campaign unchanged, which points to a remediation step that never happened.
• Attesters ask for the same explanation repeatedly, which signals that the evidence on screen does not answer the question being asked.
• Reminders and escalations fire, but nobody is ever escalated past the second level, so overdue responses sit indefinitely.

When attestation is the wrong control

Attestation is a human review, so it cannot replace controls that prevent problems. Access that should expire should expire by rule. Configuration drift should be caught by scanning. If a campaign keeps finding the same category of error, the next investment belongs in the upstream control, and the campaign should shrink to the cases that need judgment. Running a larger and larger attestation to compensate for a missing control only produces a longer audit file.

How often should an attestation run?

The cadence should follow how quickly the underlying data changes. Stable reference data may be reviewed annually, while privileged access to critical systems is often reviewed more often. Choose a cadence the attesters can honor, because a schedule nobody meets gives no assurance at all.

What if an attester is no longer in the role?

Reassign the attestation to the successor or to the manager of the former owner, and record the reassignment. An attestation signed by someone who no longer holds the responsibility is weak evidence, even when it is complete.

Can attestation results be used as audit evidence on their own?

Only in combination with the population list, the remediation records, and the timestamps showing when the population was frozen. A signed result without those attachments proves that someone clicked, not that the review covered the right people.

Should unsure answers count as approvals?

No. An unsure answer should open an investigation with a named owner and a due point for resolution. Counting it as an approval hides the open question from the people who would otherwise act on it.

Next step

If your access or configuration reviews are producing signatures without remediation, a scoped review of campaign design often finds the gap quickly. For the wider cycle, see the access recertification article, and for how the permissions are enforced, see the access control list guide.