Key Indicators and Their Practical Use

• Risk Levels and Scores: Track counts of high residual risks, average residual risk, inherent risk scores, and the number of risks with failed indicators or high ratings. These metrics help prioritize focus areas.
• Control Effectiveness: Measure the number of ineffective controls, average control effectiveness, failed control tests, and key controls with failed indicators to identify weaknesses in risk controls.
• Financial Impact Metrics: Monitor total gross and net loss from financial risk events, average losses per event, recovery rates, additional costs, and the number of events with impacts exceeding one million USD, supporting financial risk assessment and loss prevention.
• Risk Events and Assessments: Track the number of risk events (including non-financial and near misses), open risk assessments, risk assessments in monitor state, and newly created issues, tasks, and control tests each quarter to maintain active risk management processes.
• Task and Indicator Management: Keep an eye on open mitigation tasks, overdue indicator tasks, total failed indicators, and remediation tasks due for completion to ensure timely risk response and compliance.
• Loss Expectancy Metrics: Use maximum and average calculated and acceptable loss expectancy (ALE) values monthly and quarterly to forecast potential risk impacts and guide resource allocation.
• Entity and Statement Tracking: Count active entities and risk statements updated within or before the quarter to maintain an up-to-date risk inventory.

Key Outcomes for ServiceNow Customers

• Gain detailed, quantifiable insights into risk exposure, control performance, and financial impacts to inform decision-making and risk prioritization.
• Monitor risk mitigation progress through task and indicator statuses, enabling proactive management and timely remediation.
• Improve compliance and governance by tracking control effectiveness and failed tests, reducing operational and financial risk.
• Leverage comprehensive quarterly metrics to support reporting, audit readiness, and continuous improvement of risk management practices.