---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Set up advanced risk assessments for policy exception

# Set up advanced risk assessments for policy exception {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Customize the risk assessment methodology by creating your values for each question
in risk assessment and calculate your risk rating scores.

## Before you begin

Role required: sn_compliance.admin

## About this task

If you want to make changes to the Risk Assessment Methodology that is provided by
the base system or create a new methodology for policy exception, then the following
procedure must be followed after creating or updating the risk assessment
methodology for policy exception.

Map the Qualitative Rating Criteria of the risk assessment methodology with the risk
rating of the policy exception in the Policy exception risk rating mapping
(sn_compliance_policy_exception_risk_rating_mapping) table for the final risk rating
score.

## Procedure

1. Navigate to AllPolicy and ComplianceAdministrationPolicy exception risk rating mapping.
2. Enter the corresponding policy exception risk rating value for each risk assessment rating.  
   Note:  
   The qualitative rating criteria of a residual assessment from a published risk assessment methodology on policy exception table are available options in this field.
3. Click Save.  
   The score in the risk assessment is converted to the corresponding value in the policy exception risk rating column.  
   Note:  
   All qualitative rating criteria that are newly configured must have an equivalent mapping with the policy exception risk rating. If the mapping of the Risk assessment rating with the Policy exception risk rating in the Policy exception risk rating mapping table is incorrect, then the Risk rating field displays the result as NONE along with a message. In this case, you have an option to override the risk rating result of the Take risk assessment method and select a value in the Risk rating field by selecting the Override check box.

   If you are creating a
   different assessment methodology from the one that is provided by the
   base system, then you must add the sys_ID of the new methodology in the
   value field of
   sn_risk_advanced.rams_with_extension_points
   system property.
{#configure-risk-assess-method__steps_d23_bgs_h5b}

*[\>]: and then