How are other organizations monitoring and reporting on instances of non-compliance to their Procurement Policy? How do you know when there is an instance of non-compliance? (ie. Is it through self-disclosure, surveys, gathering data from ERP, etc.?) and when there is an instance of non-compliance, what happens next? (ie. How is this handled? Who is responsible? What are the implications for non-compliance?)
I am looking for a practical risk management framework to implement in ServiceNow IRM(GRC). Our specific goal is to use an existing set of cyber security risks. Any pointers will be much appreciated.