ServiceNow, Inc. (NOW) Earnings Call Transcript & Summary

And so when you think about that nirvana state, I mean, essentially, you're creating this unified system to operationalize the risk compliance and break down those silos, as you are mentioning. But also, you need a single system to -- that spans all of your risk domains, right? So how do you achieve this? Well, when you're embedding those digital workflows in each domain, whether it be security operations or human resources, supply chain or any other business function, really what you're doing is you're allowing these workflows to be quite instrumental and be that single thread across your organization, creating that visibility by automatically bringing back a lot of the risk and compliance information in one place, but also giving C-level executives the ability to see those changes in near real time, see the risk posture. So it makes a lot of the reporting very, very easily, which is the ultimate outcome of a lot of these exercises as well. So when you're bringing the processes into each domain, it just makes it much more simpler and you're able to start to reduce the level of and frequency of those assessments and evidence requests. So you're alleviating the burden on a lot of teams as well.

So that's the people, the processes -- or the processes, the technology and the people. And then you've mentioned a couple of times, you mentioned automation and then you just mentioned alleviating the manual burden on a lot of these tasks. So I mean I think of automation, I think of artificial intelligence, machine learning, how do organizations use that in analytics to drive change for a stronger risk or compliance posture?

Yes, you're absolutely right. And it's a big focus at the moment. So the need for this cutting-edge technology is really being driven by this inescapable triple whammy of the regulation and cost and market volatility that we spoke about earlier. And you're absolutely right. If you're driving automation through increased use of AI, machine learning, robotic process automation, task and document intelligence, when you're using these really incredible machine learning techniques throughout your organization, what you're doing is you're not only able to give the near-time capabilities to risk managers in the business, but you're also able to start to dive into the data and report on the current status of these compliance with confidence. Much more confidence if your data is of high quality, is surfacing the right level of information, but also knows you have a system that really knows the level of risk and knows your next best action based on your history. So -- and when you think about assigning the -- and having the right person to assess different risks and issues, you're going to get a much better outcome. So by using AI, you're able to start to -- actively start to anticipate the risk and trends, but also use task and automated business roles to start to identify the issues but also assign them to the right owner so that you can start to not only harness the recommendations that are coming out of an intelligent platform, but also start to predict and use techniques like predictive intelligence to automatically categorize and route those issues to the resolution time but also having AI-assisted answers for faster resolution. So machine learning is just this incredible capability where you're able to start to look at all the history of this data, analyze it. The machine learning model will learn over time, and you're able to start to make those accurate predictive recommendations as well. So really, this is strengthening the position for any risk owner that's starting to look into these issues to resolve.

Okay. So we talked a little bit about sort of the basics, having common source of truth, having a common language, using processes to gain better visibility, automation, managing your risks, well, about managing your risks. Let's shift gears a little bit and talk about regulations. And let's talk about something you mentioned earlier, which was ESG, I mean, because that's a hot topic. Everybody is talking about ESG. So how do these risk kind of strategies that you've been talking about address the new regulations coming in? I hear a lot of it coming in from the U.K., from Europe in general, from SEC here in the U.S. with regards to the ESG requirements.

So today, and we've just come out of COP 27 just over a week, is that it's -- there's no better time to be starting to address these kind of initiatives across the organization, but also when we think about the time line that we're on here at the moment as well to 2030 and 2050 and some of those commitments and goals that enterprises are chasing. And when we think about some of the factors that are driving this as well, it's climate change. But also, when we think about customers, shareholders, investors, they want to be informed of the impact of their investments in organization, especially if it's a publicly listed company. And demanding that communications are really timely, transparent and accurate and show that credibility around what an organization is doing in the ESG promise, and how they're driving to net zero and other low-carbon commitments. So when we think about an organization and these pressures, we know just looking at some of the statistics here that ESG is a big retention play for employees as well. When we think about 20 -- 25- to 55-odd percent reduced turnover for companies that are really -- that have very strong ESG programs and are really proficient in being able to communicate that across the organization and are true to what they are promising. But also, we're seeing policymakers are really expecting the support of this net-zero transition. And the credibility of the firm's transition plans is really what investors are looking across the board, and it can result in a lot of high stock returns, profitability and that reputation across the board, which is incredibly important for the corporation. So when we start to distill a lot of this growing attention to the issues and how -- and this pressure from all of the stakeholders internally and externally to the organization, it is a good news umbrella, though, and I do see it that way because it's a time to pivot and really grow the company and shift their business model into the next decade for what that's going to look like and seize the related opportunities that climate change and the ESG initiatives are starting to really show impact upon. And when we think about these ESG considerations, they are increasingly moving from voluntary activities to recently addressing where it's a comprehensive set of reporting. It's only getting more scrutinized and focused on. And so there's this expectation that organizations need to be clear and transparent and maintain that sound risk management policies for how they're approaching ESG more broadly. And some of the challenges that we do see when trying to deliver ESG impact across the organization is that whilst there's this growing need for reporting on ESG factors, there's also a lot of the fragmentation that we talked about earlier. But also, we need to have a workflow-driven consistent area where we're bringing all of the ESG data into and we're able to analyze it by topics and create a common understanding, where if we've got this fragmented nature of assessing a holistic view across ESG, it's really, really hard to see where the capital injection should go to be able to make those transitions effectively. And when we think about the investment life cycle that goes with implementing ESG across an organization, it's really important today more than ever that the data is very clear. But also, you see the mechanisms to be able to execute on those goals, clearly have that accountability top down in the organization and across the board. So it's certainly difficult for organizations to tackle this area at the moment. And it's compounded by the fact that -- and you mentioned this, Teresa, that globally, we're seeing ESG reporting regulations emerge and become more stringent. When we think about just recently, March 21, in the United States, the SEC proposal was really starting to mandate climate-related risk disclosures. And that's similar to SOX in 2002, and so we're seeing that evolve quite strongly. And when we think about what the SEC was mandating around disclosure guidance and what they were producing for organizations to adhere to is that in the same vein, we're seeing organizations having to collect data that they never had to report on before in new ways, especially when we look at Scope 3, which is assessing supplier and vendor risk. But companies should be applying a key piece of their SOX compliance procedures to their climate reporting processes. So when we think about the SEC proposing something like this, the CEO and the CFO will have to sign off on that data and get the Board and Audit Committee to approve these filings. And it's just incredibly command of chain that an effort that is required to put together something like this. And we also want to prevent greenwashing and the bad actions or the fabrication of data towards the market when producing these types of reports, in that the traceability and transparency is absolutely paramount with all of this focus on climate-related disclosures at the moment as well. And if we come to a key example, Teresa, and go ahead with some of -- I'd love to hear your thoughts around this as well. But I'll just give a quick example is that, looking forward, if we give an example of what a bank is assessing, I mean, a bank is looking across that physical risk of climate change, which may be assessing, for example, the fiscal risk of mortgages. So if you have property mortgages that are very close to the ocean or in a flooding plain or environment, that goes straight into the credit engine and risk domains to be assessing the physical risk of climate change and the impact on the portfolio for the bank. And the transition and climate risk drivers are really paramount as well when we think about how they're being classified and what kind of transmission channels they're coming from. So an example, maybe the transition to renewable energy or green sources of energies. What's the impact to the bank's customers? And how does that look on the balance sheet? And where does that portfolio transition to over time? So when we think about these transmission channels effectively, you're assessing climate risk drivers impact on the bank directly and indirectly through their counterparties through the assets and the economy in which this bank operates, in this example. So there's all of these geographical, I would say, factors that are really impacting the environment of that enterprise and how the bank is starting to assess these climate risk drivers. And also, when we think about that translating into financial risk, we start to look at credit market liquidity and operational risk across the board and how the bank is starting to deliver on those and responding in that way, and what that means from a liquidity perspective in terms of the cash outflows and from the capital requirements that the bank will need to hold. And then finally, when we think about that aligning to the Basel Framework, that provides this backdrop to all of this work, which is really how does an organization capture the climate-related financial risk for completeness against the Basel Framework, and how do we start to analyze that over time through stress testing, through scenario modeling and all of those types of factors as well.

Yes. And I think this -- if this is just ESG, right, you're a company, this is so broad. It touches so many different areas. It goes so high in the organization. Your leaders at the highest level are putting their reputations on the line that you are doing what you say you're going to do, and it's just ESG. And this is just ESG for the company. We're not even talking about things like the Due Diligence Act that occurred in Germany, where it's ESG for your vendors. And now let's think about security and having to adhere to various security regulations. And then you've got SOX. You mentioned SOX. SOX changed the game entirely for reporting, just like this is going to alter it again. But that's another huge one. And just think about all of those regulations, especially international organization, is having to comply with and prove that they're complying with. And it almost feels overwhelming just the regulatory landscape and how quickly it's changing. And then you factor in all of the risks that are occurring externally, the threats that are occurring externally to an organization. And you can see where a lot of organizations just really feel like it's too much to be able to get your arms around. And the thing is nothing is slowing down. It's continuing to evolve, it's continuing to change. So if you're looking forward, what should we be paying attention to, that it's going to be the next big challenge that's on the horizon that we don't want to be blindsided by?

Well, I think it's really how ESG is paving the way for new innovation in the market and effectively redividing up market share. So I want to talk about the -- the next big challenge is actually the outcomes of where we stand today with transitioning to lower-carbon economies, new market entrants. So when we think about new start-ups that are tackling the climate pledge and starting to really ruffle the feathers of incumbents and traditional organizations and coming in with complete digital-first, born-in-the-cloud, completely new business models in that addressing that competitive nature and driving at a rapid pace and responding to market needs is going to be the next big challenge for organizations because of how we've stemmed from addressing climate change and how we've had to transition business as we're seeing ore mining and gas and electricity organizations change to completely green renewable companies with a completely new business model, with a completely new supplier base, with a completely new customer base. So you're seeing absolute market disruption coming from this. So with that market disruption, how do you not only align all of your ESG frameworks but start to respond to those new market indicators and drive and grow the organization into its next chapter, given all of this. But if I touch very just quickly on how we think about facilitating ESG across the enterprise, which is going to really draw out a lot of that information and market indicators with driving that strategy, is that when we start to assess across the organization, all of the ESG metrics, we really get an insight into the way we should be performing, what value sets decision-making against some of these factors should we be taking into consideration. And then when we think about driving strategy across the board, we really need a strategic portfolio arena to be able to house all of those initiatives, that clear direction, the goals and assign that to people that can actually drive that forward into the next decade. So it really starts with not just setting goals and starting to drive to a 2030 and 2050, but thinking beyond that and being able to make more accurate decision-making based on some of the market factors that an organization is seeing. If, for example, we have suppliers that are underperforming from an ESG perspective, the organization might completely change their supplier base. And by changing their supplier base, that will have different cost implications for the organization, maybe the markets they participate in, maybe the operations and supply chain and the downstream effects of that. So it's really affecting the entire company by making some of these ESG decisions. But also, if we see that a new customer base or new target market is arising for an organization, that might have different implications from an ESG perspective in terms of participating in different countries and the types of regulations in those countries, but also how can you integrate all of this and get one single view with being able to achieve these new targets that are being scoped out for the organization. So that's really the next big challenge and where I see the next sort of chapters for organizations in being able to step forward into this environment.

And that all requires making risk-informed decisions, whether you're going to be doing with a certain vendor with you and enter a certain market or exit a market. Those are very much based upon the risks of not going into the market or being in the market. So you need that visibility to give you the ability to make those risk-informed decisions, which brings us back to your 4 recommendations to get that increased visibility. So the first thing I heard was agree upon a common taxonomy and shared understanding for risk and compliance decisions to break down the silos. It was all about breaking down the silos and having that common language. The second thing I heard was implementing processes that drive better visibility and response and connect operations such as real-time assessments and continuous monitoring to be able to have those interconnected processes across the entire organization with that common source of truth. The third thing I heard was the people. Making sure that you're engaging your frontline in addition to your second line, your third line, even your executives. Everybody needs to be engaged and equal partners, and then embedding this into familiar user experiences so people will actually engage in this, it becomes a frictionless user experience. And then the fourth thing I heard was using the automation, the intelligence to be able to drive these decisions more quickly, to respond more quickly, to get that visibility into what's happening in your organization. So being able to do those 4 different things, increasing that visibility then allows you to make those risk-informed decisions, whether it's ESG, which is what we see on the horizon as being the thing that we really need to watch carefully, or whether it's going and bringing a new vendor on, or if it's launching a new product. It's a variety of things. So people have been adding questions to our Q&A panel, and we really appreciate that. I'm going to pull a couple of them out. We only have time for a couple of questions. And I see that a couple of them are very similar, and I'll try to put them together.

So we talked about ESG and ESG regulations in the EU could become global. So the one question is if organizations are going to comply with the ESG regulations, how can they prevent greenwashing? I've heard that a couple of times recently. It's such a big topic all of a sudden.

And that's a great question because that should be the focus point. And so I'll address it in a few ways. So to address greenwashing, you really need validations and evidence collection. So that's against what you're reporting on for disclosures, but also having third-party verification organizations that you can take traceability and cross-check against is a really great way to prevent greenwashing as an organization, but also being able to tap into technology like blockchain, for example, which has a single source of truth and a verification mechanism that is effectively validating a lot of the data that is being reported. So for example, a great example is in the voluntary carbon market, we're seeing a lot of platforms that are starting to form based on -- a great example is in the financial services industry for banking. A consortium of banks are addressing how you can transact voluntary carbon markets for their customer base. And effectively, they're using blockchain technology with all of the verification parties and third parties that are validating carbon credits so that all of those parties can see the single source of truth and the data can't be modified, manipulated, you see the history of that data. And so all of that is effectively indestructible so that you -- that data can't be tempered with, the carbon credits are what they say they are and, therefore, are being priced accordingly. And all of that transparency is being used by workflows and digital automation and blockchain altogether to be able to follow the transaction through and ensure that we're preventing an organization purchasing a carbon credit that may not exist or be producing the right carbon sequestration out of the atmosphere, if it's a carbon sequestration, carbon credit as an example. So that's a few ways that you can start to streamline your processes, have everything in an integrated way that is a source of truth and start to validate some of those numbers that are being produced. That's an incredibly important part that we can play to really see the difference between the companies that are quite true to what they're claiming versus otherwise.

And I keep hearing that the penalties, the repercussions of not actually being truthful are becoming to -- beginning to come to fruition and just starting to levy. So it's definitely something that we want to be able or as companies want to be able to track accurately and be truthful in their reporting. I see just a couple of questions along these lines. Again, I'm going to kind of put it together into my own question. So people are concerned, and I know I've heard a lot about companies tightening their belts, reducing costs, trying to optimize things. There's a lot of debate about why and we know what's going to happen. Again, that whole word, uncertainty, that we talked about earlier in the webinar. But people are wondering how can they optimize what they have from a risk and compliance standpoint to be able to support these efforts that their company is undertaking and put the company in the best position going forward no matter what happens with the economy and other things?

Yes. So when we think about really tapping into more of that intelligence, that predictive nature, you're actually reducing -- you're increasing productivity of the teams involved, but then you're reducing the need to have different point solutions if you start to consolidate and you start to realize that you need a single source of truth and system of action where you can start to use things like automation that will reduce a lot of the cost of doing -- conducting those risk assessments and reporting. And all of that capital can be injected into growth opportunities and the cost base can be reduced if you've got highly productive teams that are working side-by-side with intelligent systems and automation. And when you think about really harnessing the capabilities such as things like task intelligence, continuous controls monitoring, you're starting to trigger off alerts and notifications automatically. You're starting to really tap into a contextually aware platform. That's how you'll be able to manage a lot of these environment with teams that are being attributed to the cost of servicing and the cost of assessing risk across the enterprise. So tapping into a lot of those intelligent capabilities is absolutely key. Whereas if we have manual exercises and Excel spreadsheets, we're tying up people's time. We can't focus on those signals that we talked about earlier and reduce the noise. That's number one. Then number two is really around ensuring that you have the priorities and the governance that's aligned with executing some of these initiatives, and starting to assess risk in a very proactive way as opposed to knee-jerk reaction. The governance layer is really, really paramount to ensure that everybody is aligned on that common understanding, whether it's a regulation or a taxonomy or whatever is being assessed or mapped in that, that governance framework and strong culture of strong performance and continuously improving when we think about the risk exposures and those types of things, is that you're then going from being very reactive to proactive and predictive. And that's going to set you up really, really well for the current environment.

Yes. And I don't know if it's counterintuitive or not, but the idea is you have to invest sometimes in order to be able to reduce your costs or optimize. Investing the time into taking your processes out of those spreadsheets, putting them in a formal system that's going to allow you to automate and optimize what you're doing. Wonderful information. We were actually out of time. We've got a few more questions in the queue, so we will follow up with you. We want to make sure that we connect with you off-line with the questions. We want to make sure you understand also that we do have on-demand webinars, and we encourage you to visit our on-demand site and check out all of our wonderful webinars with our industry experts and others out there. I also want to be able to see you all, hopefully, acknowledge. So please join us, connect with us, connect with your peers. It's a wonderful networking opportunity, May 14 to the 18 in Las Vegas. We look forward to seeing you there. And I want to thank you, Elisha. I want to thank all of the people that joined us today. I hope you found it as interesting and as inspiring as I did, and have a wonderful day.