A county IRM team proposes entity types that pull business services from CSDM-aligned service tables rather than only servers. When should the implementer accept service entities?

In ServiceNow IRM, entity types may target CSDM-aligned business service tables when those services are the true governable objects that own risk, controls, and compliance obligations. A county IRM team should accept service entities when obligations, ownership, and attestation live on the named business service rather than solely on underlying servers. Servers remain important supporting CIs, but they are not always the right profile for GRC scoping. Requiring completed attestation history on every related server before accepting service entities confuses prerequisite hygiene with entity-type design and delays governance of the object that already carries civic obligations. Claiming entity types may reference only hardware CI classes is false—IRM supports service, process, organization, and other non-hardware scopes. Retiring Policy and Compliance so Risk can own all service records is an unrelated application-boundary mistake; entity design is shared across IRM applications. Exam caveat: CSDM alignment enables service entities—it does not automatically make every service in-scope; filters and program scope still apply. Operational check: confirm the business service owns risk and compliance in the municipal RACI, verify the entity type table and filter against CSDM service classes, generate a pilot entity for one county service, and ensure owners can attest without forcing server-level vocabulary. Record the decision in the IRM design workshop notes so future implementers know why service entities were accepted for civic governable objects.