Advanced Risk release notes
Summarize
Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
Summary of Advanced Risk release notes
The ServiceNow® Advanced Risk application helps organizations identify, analyze, evaluate, treat, and monitor risks that could impact achieving business objectives. The Australia release introduces key enhancements that improve risk assessment accuracy, collaboration, and governance. This release also refines AI-driven risk suggestions and control objective management workflows.
Show less
Key Features
- Worst case aggregation rollup: Derives all risk scores from a single risk record based on the highest residual risk, enhancing traceability and enterprise governance.
- Hide "Not applicable" option: Administrators can remove the Not applicable choice in control and residual assessments to reduce calculation errors and improve reliability.
- Dynamic risk event assignments: Assign risk event owners, issue owners, and approvers via entity fields in addition to static user/group selection, allowing more flexible and context-driven assignments.
- Risk Suggestion AI Agent enhancements: Provides a conversational workflow to refine and confirm risks with context input and the ability to edit or remove suggested risks before adding them.
- Control Objective workflow: Enables drafting, reviewing, and approving control objective updates before activation, ensuring consistent and controlled changes.
- Parallel review and feedback: Enabled by default for risk assessment projects to support collaborative workflows without manual setup.
- Notification link redirects: Email notification links now redirect users to the appropriate workspace based on roles and access, improving usability.
- Template versioning: Risk Identification templates support versioning, allowing new versions from existing templates with assessments using the latest published version.
- Audit entries for Risk Assessment Projects: Tracks changes and activity history with audit records distinct from operational data, enhancing governance (requires Audit Management and Audit Workspace).
- Risk event workflow permissions: Risk event administrators have expanded permissions, including the ability to reopen closed events.
- ServiceNow AI Platform tiers: Introduces three AI licensing tiers—Foundation, Advanced, and Prime—providing varying levels of AI capabilities and access based on entitlements.
Activation and Related Applications
Advanced Risk must be installed via the ServiceNow Store. It integrates with GRC Risk Management to improve risk-based decision-making and with GRC Risk Workspace to provide a streamlined, single-pane risk management experience.
The ServiceNow® Advanced Risk application enables you to identify, analyze, evaluate, treat, and monitor risks that could impact your organization in achieving its business objectives. Advanced Risk was enhanced and updated in the Australia release.
Advanced Risk highlights for the Australia release
- Introduces a rollup method that derives all risk scores from a single risk record based on the highest residual risk, improving traceability and alignment.
- Eliminate inconsistent risk assessment inputs by allowing administrators to hide the Not applicable option in control and residual assessments, improving calculation accuracy and reliability.
- Assign risk event owners, issue owners, and risk event approvers based on entity fields, in addition to static user or group selection.
- Use the Risk Suggestion AI Agent to refine and confirm risks, by providing additional context and reviewing, updating, renaming, or removing suggested risks before they’re added.
- Use a structured workflow to draft, review, and approve control objective updates before making them active.
Review the updated AI experience with three licensing tiers.
See Advanced Risk Assessment for more information.
Important:
Advanced Risk is available in the ServiceNow Store. For
details, see the Activation information section of these release notes.
New in the Australia release
- Worst case aggregation rollup for risk scoring
- After upgrading to version 22.3.2, use the worst case aggregation rollup method that derives all scores from a single risk record based on the highest residual risk. You can configure this option on the Risk Assessment Methodology (RAM) form. By using a single risk record as the source, this method keeps all rolled-up scores aligned to a real risk scenario, supporting traceability, audit requirements, and enterprise governance.
- Hide Not applicable option in control and residual assessments
- After upgrading to version 22.3.2, configure the Risk Assessment Methodology (RAM) to hide the Not applicable check box in control effectiveness and residual assessment sections by using the Hide assessment not applicable option. This change reduces calculation errors and improves the reliability of assessment results.
- Parallel review and feedback for Risk assessment project
- Parallel review and feedback is now enabled by default on the risk assessment project record page and the project assessment page, in both stacked view and grid view. You can use collaborative review workflows without manual configuration, which removes the setup overhead previously required by the custom page structure of risk assessment projects.
- Redirect GRC notification links to the appropriate workspace
- After upgrading to version 22.3.2, redirect to the appropriate workspace when accessing GRC records from email notifications, based on the access and role. This feature improves usability, reduces confusion, and supports adoption of workspace-based workflows.
- Template versioning for Risk Identification
- After upgrading to version 22.3.2, Risk Identification supports smart assessment template versioning. New versions can be created from existing templates without creating a new template, and assessments use the latest published version.
- Audit entry field on Risk Assessment Project
- After upgrading to version 22.3.2, Risk Assessment Projects support audit entries to track changes and activity history. An audit entry framework separates audit-specific (third-line) records from operational (second-line)
records and controls visibility.Note:This option is available if Audit Management and Audit Workspace are installed. Assign the sn_audit_ws.third_line_manager role to a user to use this feature.
- Risk event response template enhancements
- After upgrading to version 22.0.x, users with the Risk Manager [sn_risk.manager] or Risk Admin [sn_risk.admin] role can configure risk event response templates using dynamic, entity‑driven assignments. These changes enable
assignments to be derived from entity data alongside existing static user or group selection.
You can select user fields defined on the entity (such as Owner or Sub-owner) or entity stakeholder personas when configuring:
- Risk event owner assignment
- Issue creation and assignment
- Risk event approvers
- Risk Suggestion AI Agent enhancements
- After upgrading the Now Assist for Integrated Risk Management (IRM) application to version 22.x, the Risk Suggestion AI Agent supports a more context‑aware and conversational workflow. After selecting risk types, you can provide additional context to refine search results, with the agent dynamically asking follow‑up questions when needed. Before adding risks to the suggested risk section, you can review and modify suggested risks by updating descriptions, renaming risks, or removing items from the list.
- Control Objective workflow
- After upgrading to version 22.0.x, you can use a defined workflow to update control objectives. Changes can be drafted and reviewed without changing the current active version, which helps avoid unintended changes to related controls, and risk records. Only approved updates become active. The workflow also sets clear responsibility for making updates and helps keep control objective information consistent and up to date.
Changed in this release
- Australia Patch 3
- Risk event enhancements
- Risk event administrators can manage the entire risk event workflow. This update grants permissions aligned with the Risk Manager role, including the ability to reopen closed risk events.
- ServiceNow product tiers
- The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available:
- Foundation: AI basics to deliver insights
- Advanced: AI to boost productivity across relevant use cases
- Prime: Act autonomously with all AI assets and create your own
Depending on your entitlements, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents.
Activation information
Install Advanced Risk by requesting it from the ServiceNow Store. Visit the ServiceNow Store to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.