Add a risk intelligence score to risk data for a third party
You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating.
Before you begin
Role required: sn_vdr_risk_asmt.vendor_assessment_reviewer
About this task
You typically populate the risk intelligence scores table using an integration that you created or installed from the ServiceNow Store. This procedure describes the process of updating risk intelligence scores manually.
When you request a risk score for a third party, risk intelligence providers return the score at a URL that they specify. Follow this procedure to manually add the score and URL to your risk data for the third party.
Procedure
Navigate to All > Third-party Risk Management > Risk Intelligence Provider Setup > Scores.
The Risk intelligence scores related list displays the list of current provider services and associated scores.
Scores provided by risk intelligence providers.
Select New, fill in the fields on the Risk intelligence score form, and then select Submit.
This step adds the score and the URL where the provider returned the score to the data for the third party or engagement.
When you enter a rating from a risk intelligence provider, the system normalizes the value to convert it to the appropriate TPRM rating. When you enter a score from a risk intelligence provider, the TPRM generates both a normalized rating and a normalized numerical score.
| Field | Description |
|---|---|
| Provider | Unique name of the risk intelligence provider. The choice list is populated with the providers that you registered. |
| Provider service | A name that is the concatenation of the risk intelligence provider name and the particular service that returned the risk data. You configured the service using the process specified in Set up a risk intelligence provider service. |
| Third party | Third party that was scored by the provider. |
| Request type | Level of analysis for the Score type that you defined for the service. For example, a provider might offer three request types for the Financial Risk score type: Level 1, Level 2, and Level 3. A "Level 3" report might return significantly more detailed information and might cost significantly more than a "Level 1" report. |
| URL | URL of the site that the provider returned for the request. The site provides the rating or score and additional information from the provider. |
| Raw rating / Raw score | Raw value returned by the provider in the specified URL. |
| Normalized score | If you entered a numerical raw score from the provider, then this is the computed normalized TPRM score. |
| Normalized rating | If you entered a numerical raw score or raw rating from the provider, then this is the computed normalized TPRM rating. |
| Score generated on | Date and time that the score was added to this record. Note: This is not the date/time when the data was generated by the provider. |
Add subfactor data to the risk data for the third party.
Subfactor data is not validated or mapped to TPRM score/rating data, but is stored directly as you enter it.
Navigate to All > Third-party Risk Management > Risk Intelligence Provider Setup > Subfactors and then select New.
Fill in the form in the same way as you filled in the data for a score/rating.
| Field | Description |
|---|---|
| Provider | Unique name of the risk intelligence provider. The choice list is populated with the providers that you registered. |
| Provider service | A name that is the concatenation of the risk intelligence provider name and the particular service that returned the risk data. You configured the service using the process specified in Set up a risk intelligence provider service. |
| Name | Name of the subfactor. |
| Third party | Third party that was scored by the provider. |
| Score | Raw value returned by the provider. Note: You can enter numerical or alphabetic text in this field. The value is not validated. |
| Created | Date and time that the score was added to this record. Note: This is not the date and time when the data was generated by the provider. |
Result
The data that you have associated with the third party now appears in reports. See Viewing risk intelligence scores for details. The data appears in the following locations:
- Risk intelligence scores related list as described in this procedure.
- Risk overview tab in the workspace.
- Risk intelligence scores tab in the workspace.
Parent Topic:Integrating scores from risk intelligence providers