Risk Assessment Methodology form
Use the Risk Assessment Methodology form in the Advanced Risk application to specify the types of risk assessments and the entities on which the risk assessment is performed.
See the following table for a description of the field values.
| Field | Description |
|---|---|
| Name | Name of the risk assessment methodology \(RAM\). For example, Organizational risk assessment. |
| Domain area | Domain area of the RAM. This field is automatically set to IRM. |
| State | State of the RAM. This field is automatically set to Draft. |
| Assessment Context | |
| Assess | Assessment context that you can select:- Risk: Performs the assessment for an entity and the risk statement that is related to it. - Object: Performs an assessment on any ServiceNow record. For example, users can perform an Exception Risk Assessment or a Change Risk Assessment directly on those respective tables. |
| Applicable entity classes | All entity classes that the RAM applies to, such as the business services, assets, or business applications. This field appears only when Risk is selected from Assess. |
| Applicable Record Types | Tables on which you want to perform the assessment. You can select multiple tables and associate them to the RAM. This field appears only when Object is selected from Assess.Note: You can add multiple objects or tables to a published RAM, but can’t remove them after the RAM is published. |
| Workflows | |
| Inherent risk | Option for assessing an inherent risk. |
| Control effectiveness | Option for assessing the control effectiveness. |
| Enable risk response | Option to enable the Risk Response tab on the risk assessment. This option appears only when Risk is selected from Assess. |
| Residual risk | Option for assessing a residual risk. |
| Target risk | Option for assessing a target risk. |
| Rollup Configurations | |
| This section appears only when Risk is selected from Assess. | |
| Calculate ALE based on | Formula that you can select for calculating the annual loss expectancy (ALE):- Sum - Average - Maximum - Minimum |
| Calculate score based on | Formula that you can select for calculating the score:- Average - Maximum - Minimum - Worst Case Note: The worst case aggregation rollup selects the risk record with the highest residual score and uses its inherent, control, residual, and target scores for the aggregated result. |
| Risk Response Configurations | |
| This section appears only when Risk is selected from Assess. | |
| Enable risk response task workflow | Option to enable users to create, delete, remove, edit, and link risk response tasks within an assessment. |
| Allow single risk response | Option to make the risk response selection a single select in the risk assessment form. For example, the options could be "Accept," "Avoid," "Mitigate," or "Transfer." With a single select, assessors can choose only one of these options to indicate the risk response strategy.Note: This option can only be enabled when there are no ongoing assessments. |
| Allow issue linking with risk assessment | Option to create an issue or link an existing open issue with the risk assessment. |
| Risk response is required | Option to make a risk response as required: - None: No risk response is required. - Always: Mandate a risk response always. - On specific conditions: Mandate a risk response based on specific conditions using the condition builder. - On specific conditions defined using script: Mandate a risk response under specific conditions using a predefined script or set of instructions. |
| Business Rules and Validations | |
| Final comment is required | Option to make the final comments as required. Final comments provide better transparency and enable risk owners to communicate the action plan if there’s a breach of appetite or tolerance. The options are as follows: - None: No final comment is required. - Always: Mandate final comments always. - On breach of appetite: Mandate final comments on the breach of appetite. - On breach of tolerance: Mandate final comments on the breach of tolerance. This field appears only when Risk is selected from Assess. |
| Automatically create issue | Option to create issues automatically. This field appears only when Risk is selected from Assess. - None: Enables you not to create issues automatically. - On breach of appetite: Creates issues automatically on the breach of appetite. - On breach of tolerance: Creates issues automatically on the breach of tolerance. Note: The issues are created only after the risk assessment is approved and moved to the published state. |
| Residual score is lower than inherent | Option to validate that the qualitative residual score is lower than the inherent score. Note: This option appears only when the residual risk assessment is enabled. |
| Reference Information | |
| This section appears only when Risk is selected from Assess. Enabling these options shows the reference information in the risk assessment instance. | |
| Show related risk events | Option for showing the related risk events on the risk assessment. |
| Show related risk indicators | Option for showing the related risk indicators on the risk assessment. |
| Show open issues | Option for showing the open issues on the risk assessment. |
| Show previous assessment | Option for showing the previous assessment on the risk assessment. This option helps the risk assessor to refer to the previous assessment and analyze the details of that assessment before taking another assessment. |
| Other Configurations | |
| Advanced reminder \(days\) | Based on the due date of the risk assessment, this field is the number of days before a notification is sent to the assessor. For example, if you enter 3 in this field, then the assessor gets a reminder notification three days before the due date. |
| Overdue reminder \(days\) | Based on the due date of the risk assessment, this field is the number of days after this date that reminder emails are sent. For example, assume you enter 5 in this field. Then for five days after the due date is over, the assessor keeps receiving reminder emails that the due date is over. On the sixth day, an email notification is sent to the assessor and to the assessor's manager. |
| Risk identification | Method to identify risks in the risk assessment scope:- None - From Library: Identifies risks from the library on the risk assessment. - Ad-hoc: Identifies a risk that is not in the library. - From Library and Ad-hoc: Creates risks as well as adds risks from the library. |
| Group factor comments | Option to enable group factor comments in the risk assessment form. |
| Copy previous responses | Option to copy the factor responses and comments whenever a reassessment is performed. |
| Allow override of results | Option to override the computed scores and the ALE during risk assessment. |
| Configure section terminology | Option to configure section labels for inherent, control, residual, and target assessments. After you select this option, you can configure the title, score label, and annual loss expectancy label for each assessment type.Note: Section label renaming applies only to the advanced risk assessment interface while leaving the terminology used in reports, dashboards, heatmaps, and other areas unchanged. |
| Update assessment results to source record | Option to copy the assessment results to the source record on which the assessment is performed. You can define the assessment result mapping for the applicable record types in the individual assessment types. This field appears only when Object is selected from Assess. |
| Schedule | |
| This section appears only when Object is selected from Assess. | |
| Reassessment frequency | Option of how often the reassessment is performed:- None - Weekly - Monthly - Quarterly - Semi-annually - Annually |
| Days to overdue | Based on the due date of the risk assessment, this field is the number of days after which an assessment is considered overdue. |
Parent Topic:Configure a risk assessment methodology