ServiceNow GRC pricing per IRM operator, and who counts as one

The short answer: ServiceNow GRC, sold as Integrated Risk Management (IRM), lists at $125 per IRM operator a month for Standard, $250 for Professional and $375 for Enterprise. That is $1,500 to $4,500 per person a year at list. ServiceNow itself prints no price, so these figures come from two of its resellers' January 2026 price lists on the UK government's G-Cloud 15 framework. The number that decides your bill is not the rate. It is how many people count as an operator.

Every figure below was read on October 14, 2026 from those price lists: Fujitsu's, which quotes ServiceNow in dollars, and Computacenter's, which quotes the same products in pounds. Both are labelled indicative, and partners discount from them. If you are pricing a GRC platform that is not built on ServiceNow, compare it with the Riskonnect pricing lists, which meter applications rather than people.

How much does ServiceNow GRC cost?

The three IRM editions are priced per IRM operator per month. The dollar column is Fujitsu's list. The pound column is Computacenter's list for the same SKUs, and it sits at exactly 81 percent of the dollar figure on all three lines, which tells you both resellers are working from the same ServiceNow price book.

The last two dollar figures are not printed in the Fujitsu list. They are the pound prices divided by the same 0.81 ratio the three editions share, so treat them as close estimates. A team of 25 risk and compliance staff on Professional lists at $75,000 a year. Published third-party estimates of $150 to $300 per user per month are consistent with these lists once you allow for the edition mix. On recorded contracts across all ServiceNow products, Vendr data read on 3 September 2026 put the median at about $127,118 a year.

One caution on the arithmetic: these are prices for the IRM application seats. A company with no existing ServiceNow instance may also be quoted platform entitlements and the partner who configures it, so ask every quote to state whether it assumes an instance you already own.

What is an IRM operator in ServiceNow?

Computacenter's list carries ServiceNow's own definition: an IRM operator is "any User who contributes to, or is part of, an IRM application workflow or process in any way, including the receipt of an attestation or assessment request." Read the last clause twice. A sales manager who answers one control attestation a year is, by that definition, an operator at the same price as your head of compliance.

The escape hatch is the IRM Lite operator at £60.75 a month. A Lite operator can respond to policy acknowledgments, control attestations, evidence requests, risk identification questionnaires and classic risk assessments, and update assigned issues and remediation tasks. In other words, everything a first-line control owner normally does. The difference between licensing 400 attesters as Professional operators and as Lite operators is roughly $1.2 million against $360,000 a year at list.

So the first job before any quote is a headcount by role: who designs and tests controls, who only attests, and who only acknowledges a policy. If your attestation workflow mainly routes small tasks to named owners, it is worth asking whether a dedicated task assignment tool covers that part of the work for less than an operator seat.

What is the difference between ServiceNow IRM Standard, Professional and Enterprise?

The edition descriptions on the reseller lists name the applications each one includes.

• Standard ($125): policy and compliance management, governance risk and compliance, compliance case management, risk management, AI risk and compliance management, audit management, model risk management and use case accelerators.
• Professional ($250): everything in Standard plus advanced risk management, advanced audit management, advanced use case accelerators, GRC metrics, parallel review and feedback, regulatory change management, predictive intelligence and the cybersecurity executive dashboard.
• Enterprise ($375): everything in Professional plus Virtual Agent and risk event handling, which the Lite operator definition says applies to IRM Enterprise customers only. The edition descriptions are cut off in the price list cells, so ask for the full entitlement list in writing.

The line most compliance teams care about is regulatory change management, and it starts at Professional. To get it, every operator pays double the Standard rate, not only the people who read regulatory updates.

The add-ons that grow a ServiceNow GRC quote

Two of these deserve attention. Third-party risk is priced on vendors under active management, so a program with 200 active vendors lists near £116,640 a year, and the count rises as onboarding improves. Performance Analytics is a percentage, which means it grows automatically every time you add operators. Ask for both to be priced as fixed lines.

Is ServiceNow GRC worth it?

For a company that already runs ServiceNow for IT service management, often yes. The configuration management database, the admins and the integration work are already paid for, IT risk can map straight onto real assets, and the risk team inherits a platform the business already logs into. That is a real advantage no standalone GRC tool can match.

For a company buying the platform mainly for GRC, usually not. The per-operator meter punishes broad participation, implementation is done by partners on their own day rates, and the regulatory content still has to come from somewhere. Compare it with tools that meter applications or modules, such as RSA Archer, LogicGate or the options on our integrated risk management software guide.

How to negotiate ServiceNow GRC pricing

1. Count operators by role. Send the partner three numbers: full operators, Lite operators, policy acknowledgers. Get the counting rule into the order form.
2. Price Standard first. If you only need regulatory change management from Professional, price that need separately before moving every seat up an edition.
3. Get two partners to quote. One G-Cloud reseller lists 0 percent volume discount at every contract value; another lists 5 to 10 percent. Partner margins differ, and that difference is yours to capture.
4. Cap the percentage add-ons. Performance Analytics at 20 percent of GRC spend should be a fixed figure, not a share of a number that will grow.

Where ComplianceOfficer fits

ServiceNow's regulatory change management application organizes the regulatory content you feed it. It does not decide which new federal or state rule matters to your firm. ComplianceOfficer does that part: it keeps a register of the obligations that apply to you, checks the primary sources every day, explains each change in plain language and drafts the policy update for every gap you mark. It costs $149 a month for one owner, with no operator count, and the scan at the top of this page shows your register in under a minute. It runs alongside a ServiceNow deployment or in place of the Professional upgrade for a team that only needed that one application.