ServiceNow, Inc. (NOW) Earnings Call Transcript & Summary

Thanks, Rawda, I do. Yes, in fact. This is just a small sample of -- because we're constrained by time -- a small sample of AI that we're delivering on. And you can imagine, as a firm that spends, I think last year we spent over $2 billion on research and development, we are the only GRC firm, and the only IRM firm that's digitizing the work side of the house, the first-line activities. And so -- if you think about where we want to go as a business, as a large business, we're really focused on GenAI. We're really focused on driving business outcomes with GenAI, for example. And so it gives us a unique opportunity to see both sides of the fence. And what I mean by that is -- unfortunately, I don't have the slide here, but this is a good follow-up conversation for us to have one-on-one after these -- after the webinar, we have -- we're obviously customer zero for the software that we create. And so our CIO function has in fact really beta tested and continues to be the ones that adopt the newest innovation that we have on our platform. And they have unleashed AI within our CIO function. And what I find really interesting is to be able to see in the GenAI outputs in the dashboard, the CIOs dashboard, is to be able to see what they would really be considering performance data, performance data from the perspective of like changes, change velocity, change failures, for example, or vulnerabilities and patches, things like that. They're looking at metrics from a performance indicator, but in the risk and compliance world, right, what we would often see is that there's an inverse relationship between performance indicators on the business side and risk indicators on the risk compliance side. And so as I look at the performance indicators, I am actually seeing really insightful data that's being gleaned through GenAI capabilities around technology risk that in fact we're not quite yet seeing through the traditional model of risk management using a GRC technology. So what this gives us as a firm is a unique opportunity to be able to say, all right, well, what I want to do is, I want to scrape the data from the dashboards of the CIO, the CHRO, the CISO and others in order to be able to pull that information in, evaluate where we see perhaps performance metrics on their side that are trending downward, and the KRIs that are trending upward. I want that relationship to be made. And it could inform ways that I may accelerate ideas and concepts around risk and compliance, right? Effectively, I'm skipping a few steps as the organization in the risk compliance world matures. I'm skipping a few steps because our business is moving so fast and using this technology, but now I can just take advantage of the information that they are supplying for themselves and use that for the role that I need to -- and I don't have an internal risk management role, but this is how I'm interacting with our teams in order to drive for sort of these new concepts. And so I think that's really important, is to really consider it's going to be difficult to identify where firms are -- your business partners might be using GenAI. But once you do, once you're able to do that, right, then we have a path backward to the models that they're using, right, which is going to be really important from a model risk management perspective. And also to be able to leverage that information or those insights that they're getting from their use of GenAI in order to accomplish sort of the two birds with one stone idea from a performance and a risk perspective. So I'm going to hop into -- the next section was around navigating with confidence. And a pretty simple slide here, but something that I really want to spend quite a bit of time on here. And this is from -- this is -- what we have here is, in effect, 3 insights that we found from what we call risk leaders. And this was performed, a survey that we did with a company called ThoughtLab last year. And we effectively created this survey because we couldn't find the data that we were really looking for relative to understanding risk and compliance more holistically and sort of the direction that firms are going or the industry is going. And so we separated them into tiers, right? We -- lower end, less mature organizations, sort of middle or medium tier, and then the high end tier, which is the people that are really forward-thinking around risk and compliance management. And so if you were to think about -- I've had, in fact, a CRO say to me, well, I'm not trying to be a risk leader, which I thought was kind of interesting. And I said, well, characterized in that way, I can perhaps understand why you might say that, but your whole -- sole purpose is to guide your business, right, and so business counterparts. And so I would say from that perspective, you do want to be a risk leader, because unless you're a risk leader, you're going to continue to manage the downside of risk. You're going to continue to look in the rearview mirror. You're going to continue to report the news rather than being on the leading edge of your business activities, right, understanding where you have room in your risk appetite to take additional risks. And this is the concepts that we're seeing in the risk leader space. And there are these 3 -- first 3 or the top 3, I would say, insights that we got from those results, which, by the way, was I think, 750 or so C-level executives or C-1s that we targeted, we had 50 CEOs reply and it was a range of institutions across the globe. We did a distribution that was about 250 people in the Americas, 250 in Europe and 250 in the APJ region. So we have a really good sample size that covers the globe, covers all different sizes of institutions. So the first that they came back with is that they're all striving for a single source of truth. Now I think -- Rawda and I, in fact, were having this conversation the other day about data lakes or lakehouses and some of these concepts. And they exist, but they have yet to prove, I think, at scale at least, that they are really valuable from a risk and compliance perspective. So this is one of those times if I was a creator, an influencer, I would say, hey, put it in the chat below, let me know if you disagree with me, that's maybe an opportunity for you to have some questions here, that we've included in this conversation here in just a few minutes. But I see that most firms are really thinking about how do we have a single source of truth from a risk and compliance perspective. Not necessarily a single source of truth from a business and performance perspective -- that's necessary, obviously, right, you've got to have a 360 view of your customer. That's really important, right? You can span across all businesses. They have lots of touch points in your company. So being able to understand your customer is really important. But what we often miss out on is, I think, from a technology investment perspective, is how do we do something for the business but also do something for the risk and compliance teams that are helping those businesses. And so the risk leaders are really focused on creating a single source of truth. And McKinsey says we're in this sort of -- data fabric is going to change this a little bit, so as GenAI moves forward and we have new concepts like Data Fabric, this is perhaps going to change what I'm about to say. But McKinsey was saying, within the last year, right, that we're in the learn and train mode for GenAI. And learn and train mode needs as -- it needs good data. Otherwise you're spending a lot of time learning and training, and you're not getting a lot of the outcomes that you'd want to get from that data. And so McKinsey has theorized that data products are the secret sauce for scaling AI. And they use, I think, an example around customers -- having that -- all that investment we've made in the 360 view of customers so that we know when they're touching a couple of lines of business, how we can upsell or cross-sell, for example, right, we might [ want to ] see where they have disappointment, we're able to perhaps improve service for them. But this is a really important concept for us to consider around risk and compliance as well, having a 360 view. And the data products should be at the lowest level in the organization. And I'll just tell you that ServiceNow has a concept called entity structures in our software. And people often go to this idea of entities being just a legal entity, but an entity is really just a thing. It's a person, place or thing. It's an object, if you will. And there's everything in your business, from a network router to a human being to a product, has regulatory obligations associated with it -- policy obligations, right, risks, controls, and can result in issues or losses. And so getting down to the lowest level in the organization in these data products is where you're going to start to see high value from GenAI in the future. Firms that are really thinking about structuring the data to that level so that GenAI can make quick use of that information in a very structured way. So you need to be able to see those assets and those activities and all the things that apply to them from a risk or compliance perspective. And as you think about ServiceNow as an enterprise platform for transformation, we're digitizing controls relative to change management or vulnerability management or onboarding your customers or we have a partnership with Visa around dispute management. We're digitizing the controls of these processes. For us, it's a natural opportunity to have on the same platform this single source of truth between the business activity and the risk compliance and control activity. We're digitizing the controls on the left-hand side, and we're able to use that information very quickly on the right-hand side. The second concept they're focused on is really integrated risk processes. And I think that most firms would -- given that GRC technology is catering to the second line or third line, that most firms are really thinking, and we saw this with the KPMG statistic around CROs that are investing. I think less than 10% are investing at least $5 million in helping integrate with the first line, right? That's a very tiny number, if I didn't say that earlier. But the leaders are really focused on what I would say is inter- and intra-line processes. They must both be reimagined in terms of outcomes to simplify and digitize. And so the leaders are thinking about first line, second line and third line, if they can all hop into the same train. Often it's first and second line, those are the two that need to be working the most closely together. Thinking about how they bring those teams together, within the first line, within the second line, and then across the first and second line. And if you think about concepts that we've talked about here around AI and operational resilience, this is so important. These things are moving so quickly that you have to have digitization that exists between first and second line in order to understand the risk and do something about it and then understand the incident or the event and do something about it. Those are going to be critical. Those gaps in time must shrink from identification to reaction. And then the last one is around end-to-end risk management. And I would say that operational resilience -- now we're going to -- what we're going to see is a wave of firms that have probably taken an MVP approach to operational resilience. They're going to have SharePoint sites and spreadsheets and all kinds of things that I would consider not within the realm of resilience in terms of a definition. But they're going to do it because, right, this is new, and they're going to see what they can effectively get away with. It's a very sound strategy, I think, from a compliance -- risk and compliance space, but regulators are going to go though and they're going to identify who the leaders are. And in fact, I would say that we've already found customers who use ServiceNow for operational resilience who have told us that they have realized that this is a competitive differentiation for them. And in fact, it hinders us because they've told us they won't be reference customers for us -- good problem for us to have, we'll sort through that. But the point is, is that operational resilience requires end-to-end risk management, and end-to-end risk management, as I mentioned earlier, requires really composable design concepts and hyperautomation concepts. You've got to be thinking about those 2 things to change the way you work, because we are at that inflection point. The future of risk management is continuous monitoring. If I recall from that Westpac article, they feel that the industry is stuck around the 40%, 40% of controls can be monitored. And Westpac is looking at something they feel they can confidently get to somewhere around 70%. And when you think about continuous monitoring, once you have that in place, you can automate compliance more. You can trigger assessments using these data products. You can -- you're obviously going to keep your RCSAs. You have to do something that tells the story at the highest level in the organization, but the industry's struggled to get down to process risk and control assessments. And through these data products and the concepts we have already built into our solutions and the digitization of the business, the processes on the left-hand side with the integrated risk management capabilities on the right-hand side, getting to a place where you can trigger risk assessments down to the process levels, down to the process owner, for example, down to the control owner, this is possible with us today. And this is the future of risk and compliance automation. This is how we get beyond all of the repetitiveness we see in each report that Thomson Reuters puts out every year around, right, not having the right skill sets in place, not having the capacity to do the job, always having an increase in regulatory compliance obligations. This is really what we need to think about. So we're going to hop over this last one. Just want to give you some information here relative to what we're trying to communicate and a little more for you to dive into post this conversation. We have a couple of videos and some things you can read on our latest release. As Rawda mentioned, right, the AI we have relative to regulations and controls is one in our newest release, and so I'd encourage you to go read up on that. And then we do want to have a little bit of time here for Q&A. So if we have any questions that have come up through the conversation today, we'd love to be able to address those. And then we'll save a few minutes here at the end for us to be able to close out with some future webinars or fireside chats that we have and some other events. So do we have any questions that have been queued up?

We have a couple.

Okay.

So let me read out the first one: so my business partners are using GenAI in various parts of the business. Do you see other firms using GenAI from a risk or compliance perspective yet?

Yes. This is a good one. I mean, I think what I'm hearing is from firms is we know our businesses are using GenAI, which the question acknowledges. They don't have a full handle on how they're using or where they're using GenAI. I think that's just -- that's the condition of the industry at the moment. And I am seeing some, I'd say, pretty successful elements of AI taking place in what I would say is more of the structured elements of risk and compliance. So like if you think about in the credit risk side of the house, being able to leverage information that is -- that allows you to have boundaries, for example, within your boundaries and limits, for example, those sorts of things are fairly easy for us to adopt GenAI capabilities in. But when you get down to the operational side of the house, the operational risk elements, those are historically always been really difficult for firms to manage. And you think about, as resilience -- operational resilience is an outcome of what I would say is good or proper operational risk management, having the fragmentation that sits within operational risk teams in terms of documenting business processes in a BPM tool that's disconnected from a GRC tool or, right, needs to be stitched together through human middleware, those become -- it becomes a lot harder for us to deploy, at the current time, deploy those capabilities around AI in that space. But as we're seeing from that survey, leaders are really thinking differently and thinking about how they can create these concepts through things like data products.

That is quite correct, especially from an operational [ learnings ] perspective, as you said, Michael. Especially from the operations side, it is forcing leaders or it's making a lot of leaders rethink their strategy about how do they discover, how do they monitor, how do they capture the data points to enable them to automate, because that human middleware is not going to be working for them too long. It's not going to be a sustainable solution as we go into the next years and how to be more competitive. So yes, that is quite correct. The other question that we have: with firms having presence in multiple jurisdictions and having to comply with multiple regulations, how can technology, namely ServiceNow, help in streamlining or harmonizing compliance across these geographies?

How much time do we have left? That's a big question. I think maybe a couple of ways that I'm seeing this happen. And I'll talk through the lens of ServiceNow obviously, but -- so there's a couple of ways that we're trying to do this, assist with this idea of efficiency and effectiveness from a regulatory harmonization perspective. So the first is like being able to really, again, going back to this entity structure, entity models that we have in our integrated risk management solution that allow you to get down to the data product level, which is, again, what McKinsey says is the secret sauce to scaling AI. We have this concept of being able to assign at a top level -- a set of controls at a top level and cascade down. And so for example, right, you might have a regulatory obligation around change management that needs to be associated with your internal policies and procedures around change management, right? You must ensure that you're doing the things internally that are expected of your regulators externally. And then those cascade down into the data products that apply to change management, for example. And so this allows you to say, well, I might have, I don't know, some firms have a dozen change management -- major change management processes across the organization. They might have one for crown jewels, they might have one for P1 assets, whatever, different dev environments. And so being able to cascade that down, right, to each one of those change management data products allows us then to have what I would say is the digital connections to be able to go back up the stack. So I've described it down -- coming down the stack from regulation to policy, down to the data product, down to the actual activity. But then you think about what we're trying to do from either a monitoring, continuous monitoring and testing perspective, which is going back up the stack. And so this allows us, right, to get to a place where when we have those digital connections between all of these things, with data products and otherwise called entities for us sitting at the center, then we can come back to this concept of testing once, complying many times, and being able to see compliance scoring relative to that across each of the data products. That's really important. The second thing that I'm seeing is we're investing in partnerships. We recently released or entered a partnership and released content from Cyber Risk Institute. And Cyber Risk Institute is U.S.-based nonprofit. It was originally formed in the government, the U.S. government, but is a nonprofit now. And they effectively are looking at how do you take and then -- they've got great content, I encourage you go read up on our ServiceNow docs site about this. But they're effectively taking things like NIST and NISO, the foundations we would see across most organizations, and to be able to then harmonize those, what I would say is global standards, down to financial services-specific regulatory obligations. And so again, concept of sort of test once, comply many times, we're doing that additionally by providing content, in this case, through Cyber Risk Institute.

So just to highlight as well, just to add another point. So from a -- so I -- we mentioned that in a couple of slides before, about how -- from a technology perspective, we do see that there is a shift in how compliance, operational resilience, discovery of elements or how infrastructure needs to be linked from the lowest part of the organization to the process to the service to all of that. So one of the things is just like AI helps you harmonize, or just, for example, if there's any kind of regulation that comes in, they would, for example, one of the AI capabilities is trying to map or trying to elevate the manual task is taking away some of the time that you spend reading the regulation than reading your internal controls or your internal policies and trying just to understand, are they repeated? Do I have the controls that cover this regulation? Do I not? For example, Michael, you mentioned change management. Change management, I think, is a staple across a lot of operational resilience regulations. So one of the things that we see maybe as a low-hanging fruit is, from a GenAI to an AI capability is, it will read whatever operational resilience regulation out there and it will tell you: by the way, your internal environment, 90% complies with this regulation, you just need to add another 10% on top. So that's also part of how we see GenAI, AI changing this whole compliance discourse that is going on plus the risk, because if you're good on compliance, then you're mitigating your residual risk, so you're able to have a risk appetite, be able to do the R&D, be more competitive within the market and so on and so forth. So we do have a final question.

Okay.

"The general consensus in my company is that most people are unhappy with our current GRC tool," ooh, "but politics keep it in place." Very saucy question, that one. "What is your advice on how to navigate the introduction of modern GRC solutions?"

This is a difficult one. I think that if you spend 20 or 25 years in the banking world, you'll probably only go through -- probably only replace a GRC system perhaps twice. And it's just one of those things that is so deeply entrenched in an organization that switching to something else despite how you feel about the current solution becomes very problematic and very, very costly for most firms, right? And that's the way they view it. And so they generally just make do and have lots of end-user compute tools that supplement the gaps that are in their GRC technology. I'm sure that what I'm saying is -- people are shaking their heads up and down -- but what I see as an opportunity is like there's very few organizations that come to us and say, hey, we're going to -- we want to rip out whatever we have and put in ServiceNow. Some do. But most of the ones that I'm seeing that have this sort of political component to keeping it, they're looking at ServiceNow at -- as sort of picking off use cases. So maybe there's something that the current technology you have doesn't do and you're making up for that gap in -- and using compute tools. Maybe it's a program -- individual program you created or it's in Excel, right, and doing manipulation in Excel. And so that's a good opportunity to introduce the idea of can we do a proof of concept around a use case that we are not currently covering in a way that we should that's really inefficient and perhaps ineffective. And/or another opportunity is, look, we have this use case in our current system, but the use case isn't providing us the results we need. It's not generating the outcomes we need. And so this is another opportunity for us to think about just, at the use case level, how can we drive some change. And I think what you'll find with ServiceNow is what I call the workflow, the big W, is about uniting the people and the teams across the lines of business. And so that's where we really shine, and ideally what we have is a situation where we can showcase that, right? We can showcase how we can integrate with your current GRC system. We can showcase how we bring first and second and even third line together on our platform and do that in a way that is much more efficient, much more effective perhaps than the way you do it today. So I would encourage you to take us up on that offer. If you have a use case out there that's just really problematic and you're in a situation where you can't displace the GRC solution just yet, you need to gain some momentum, the use case level and building our way up the momentum up the stack is a way to do that. I think that's the all the time we have for the session today. I've got a couple of slides to cover at the end here. And so I'll close this out here. Rawda, thanks for joining me today. I really appreciate it. It's been great to work with you on this. But we have a fireside chat coming up this -- next month, in fact, a little over 3 weeks away, that's going to feature Dave Wright and our Deputy CISO, Jeff DiMuro. And we'd love for you to join us. We think that this is very closely in line with the conversation we've had today, and this is going to be around cybersecurity resilience and resilience in the world of AI. So it's a similar topic, but you're going to hear from people that are on the leading edge in our firm, inside ServiceNow, on AI and cybersecurity. On-demand webinars, we have a link here for this, and I think you have access to this information. So I'd really appreciate it if you guys take a look at that. We've got a couple of world forums that are -- they're coming up next month as well, November 7 in New York and the 13th in Toronto. You have a QR code there. If you click on the QR code you'll get more information. And that's going to close us out for the day with 1 minute to spare. So we're going to give you 1 minute back in your life. You'll have just enough time for perhaps a bathroom break before your next meeting starts. Appreciate your time today. Thank you very much for joining us. You can always find Rawda and I on LinkedIn, or reach out to somebody you know in ServiceNow. Happy to have follow-up conversations from anything you heard today or start a new conversation. Thanks so much. Enjoy the rest of your day.