What a ServiceNow Instance Health Audit Actually Finds in Ten Days

A new CIO at a mid-market insurer inherited a ServiceNow instance last February. Three years of implementation under a Big 4 partner, two go-lives, one half-finished HRSD rollout, and a renewal invoice sitting on her desk for a licence tier she could not justify. She asked her ServiceNow account manager what state the platform was in. He said “healthy, you’re on Washington.” That was the answer. On a half-million-euro-a-year platform.

She called us the following week.

Ten business days later she had a 42-page report, a dashboard with 46 scored items across six dimensions, and a conversation to have with her account manager that was no longer symmetric. The instance was not broken. It also was not healthy. It was the normal condition of a ServiceNow instance that has had three years of change, two partner handovers, and nobody specifically paid to look after it.

That is what a servicenow instance health audit is actually for. Not to tell you the platform is up. To tell you what is quietly costing you money, time, and leverage.

The hidden cost of skipping a servicenow audit

Operations teams judge the platform by whether tickets flow. Users judge it by whether the portal loads. Finance judges it by whether the invoice matches the SOW. All three can be green while the instance is burning.

The things that break slowly are the things nobody is paid to measure. ACLs that drift as roles get added. Scheduled jobs that nobody can trace back to an owner. Flows that still reference a terminated employee’s user record. Business rules that were cloned, forked, then abandoned in both places. A CMDB whose relationships were right at go-live and have been quietly rotting since.

None of that triggers a P1. All of it costs you something every quarter. Response time on major incidents gets slower because the CMDB cannot tell you what depends on what. Change failure rate creeps up because the test instances no longer match production. Licence costs balloon because custom tables duplicate functionality that already exists OOTB. The partner invoices for “stabilisation work” grow quietly line by line, because they are the only ones who know where the bodies are buried.

A proper servicenow audit catches these before they turn into the kind of problem that lands on a board slide. Not by running a vendor scanner over the instance. By having a senior architect read the actual code, trace the actual flows, and ask the questions a scanner cannot ask. Why does this exist. Who added it. What would happen if we turned it off.

The six dimensions worth scoring

A diagnostic that just says “your instance has 1,842 custom business rules” is useless. The number tells you nothing. What matters is which of them should not exist, which of them conflict with each other, and which of them silently override OOTB behaviour in a way that will bite you at the next upgrade.

The Milic Media servicenow instance health audit scores six dimensions, each with a weight. The weights are not arbitrary. They come from four years of looking at mid-market instances and tracking which categories of problem turn into real cost soonest.

Platform hygiene

Everything that governs how the instance evolves. Update set discipline, naming conventions, update-set collisions in the pipeline, dev-to-prod drift, cloned records, orphaned scripts, scheduled jobs with no owner, workflows and flows duplicated across scope. Platform hygiene is the dimension that correlates most strongly with how painful your next upgrade will be. A low hygiene score does not block upgrades. It just means the upgrade will cost you three times what the vendor quoted.

Security

ACLs, roles, scoped applications, elevated privileges granted for an incident and never revoked, data-export policies, API keys stored in plain text inside script includes, HR security policies patched enough times that nobody can predict their behaviour. This is the dimension that worries CISOs and should.

Performance

Long-running scheduled jobs, business rules that iterate GlideRecords inside loops, client scripts that fire on every form load, dashboard queries that scan tables with 40 million rows and no index. Performance scores track what will stop your users complaining about speed.

Customisations

Not “how much have you customised” but “how much of what you customised was necessary.” Every custom table that duplicates an OOTB one. Every workflow that reinvents an OOTB flow because the previous team did not know the flow existed. Every portal widget built in Service Portal when Employee Center would have done the job. This is the heaviest contributor to technical debt on a typical mid-market instance, and the easiest to defer indefinitely.

Integrations

MID servers, IntegrationHub flows, REST and SOAP endpoints, SAP and Workday and SuccessFactors flows. What they do. What they fail at. What they retry. Who owns them. Whether the credentials rotate. Integrations are where the platform meets the rest of your estate, and where the biggest hidden risk tends to sit.

Roadmap readiness

Whether the instance can actually absorb the next six to twelve months of planned work. If you are rolling out ITOM, FSM, or extending HRSD, roadmap readiness tells you what has to be fixed first and what can be done in parallel. It is the only dimension that looks forward instead of back.

The ten-day cadence, and why it is ten

The ten-day timeline is not a marketing choice. It is the minimum credible time to look at an enterprise instance, and the maximum we can commit to a fixed-fee engagement without padding the number.

Day one is the scoping call. We agree what we are allowed to see, which admin role we need, and which stakeholders we need thirty minutes with each. Days two through seven are the actual audit. One senior architect, read access to the instance, and a lot of time spent in the Studio, the plugin manager, the update-set table, the flow designer, and the sys_db_object list. Day eight is scoring and triage. Day nine is report write-up. Day ten is the readout.

The output is a scored dashboard, a prioritised remediation list, and a conversation with the person who paid for the audit. The prioritised list matters more than the score. A score of 68 out of 100 tells you nothing you can act on. A list that says “fix these five things in the next quarter, these twelve in the next two quarters, and these twenty-nine after that” is a plan.

The thing we do not do is use the audit to sell you the remediation work. The audit price is fixed, the deliverable is yours, and if you want someone else to do the fixes, we hand over the artefacts and wish you luck. More than half of the audits we have done have ended with the client giving the remediation list to their existing partner. That is fine. The point of the audit is that you now know what to ask them for.

Where to start, practically

If you have inherited an instance, or you are three years past go-live and your partner has not told you anything concerning in a while, there are four moves worth making this quarter.

First, pull the update-set table yourself. Count how many update sets have been in “In progress” state for more than ninety days. If that number is above ten, your platform hygiene is already a problem. The fix is not technical. It is a weekly fifteen-minute meeting with whoever owns the pipeline.

Second, list every scheduled job and ask who owns it. Any job nobody can name an owner for is a candidate for disabling. The scheduler is the single most common source of silent cost on a mid-market instance, and the fastest dimension to clean up.

Third, pull the ACL table and filter for ACLs created in the last twelve months. Read them. The ones that confuse you are the ones to worry about. Security drift is cumulative and it does not announce itself.

Fourth, if any of this is too hard to do internally, that is itself a finding. An instance you cannot audit yourself is an instance where the partner has more leverage over you than you have over them. That is the position worth getting out of.

If you want an external architect to do all four properly, with a scored output and a readout, that is what the Milic Media 10-Day Instance Health Report is. Fixed fee, ten business days, no retainer attached, and the artefact belongs to you. If you want to see the kind of work this produces before engaging, the Milic Media case studies walk through two anonymised audits and what they turned into for the clients.

Either way, “your platform is healthy, you’re on Washington” is not a status update. It is a vacuum where a status update should be. Fill it, and the next three years of ownership stop being an act of faith.

Mladen Milic runs Milic Media Kft, a boutique ServiceNow consultancy delivering implementation, health audits and HRSD work across the EU. Reach him at mladen@milicmedia.com.