Understanding the risk assessment instance

  • Release version: Yokohama
  • Updated January 30, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Understanding the risk assessment instance

    A risk assessment instance in ServiceNow GRC is where risk assessors evaluate risks and related objects by answering configured questions or factors. This process begins after creating a Risk Assessment Methodology (RAM) and defining the scope, with the risk administrator initiating assessments. Assessors receive notifications and must have thesngrc.businessuserrole to perform assessments, which calculate a risk score for the entity.

    Show full answer Show less

    Key Features

    • Role Requirements: Assessors need the sngrc.businessuser role, with advanced risk assessment roles manually assigned. Role and group granting can be managed via background jobs.
    • Assessment Factors: RAM configures questions; factors can be manual (requiring human input) or automated (responses calculated automatically on a defined schedule).
    • Reassessment: Triggered automatically based on frequency if the assessment is in the Monitor state; automated factors update scores accordingly.
    • Reassignment and Response Modification: Assessors can reassign assessments or modify responses after initial input.
    • Response Copying: If enabled, previous assessment responses copy to new assessments, except for automated factor responses and overridden scores.
    • Related Lists on Assessment Form: Displays previous assessments, risk events, risk indicators, open issues, risk response tasks, and related controls (when assessing control environments).
    • Opting Out of Control Assessment: Assessors may opt out of assessing mitigating controls when no controls exist (e.g., uncontrollable risks like pandemics), resulting in a “Not applicable” score for residual risks.
    • Control Assessment Defaults: If controls are associated and assessed individually, opting out is disabled since controls are mandatory in that context.

    Stages of Risk Assessment

    The risk assessment lifecycle includes the following states, guiding assessors through a structured evaluation:

    • Ready to assess: New assessment instance creation.
    • Inherent assessment: Evaluation of inherent risks.
    • Control assessment: Assessment of mitigating controls.
    • Residual assessment: Evaluation of residual risks after controls.
    • Target assessment: Target risk level assessment.
    • Respond: Taking action on risks.
    • Awaiting approval: Pending approval from designated approvers.
    • Monitor: Completed assessments under ongoing monitoring with automated updates from scheduled factors.

    Practical Considerations for ServiceNow Customers

    ServiceNow customers should ensure correct role assignments for assessors and configure RAM to suit their organizational risk processes. Automated scheduling of factors and reassessment frequencies enable continuous risk monitoring. The ability to reassign assessments and modify responses adds flexibility. Understanding control assessment options helps in evaluating risks with or without mitigating controls. Monitoring the assessment lifecycle stages assists in tracking progress and ensuring compliance with risk management policies.

    A risk assessment instance is where a risk assessor can assess risks and objects by responding to questions or factors.

    After the risk assessment methodology (RAM) is created and the risk assessment scope is defined, the assessments are initiated by the risk administrator. The assessor receives a notification to assess the risks. To perform the risk assessment, an assessor must have the sn_grc.business_user role. The assessment is used to arrive at a risk score for an entity.
    Note:
    You must manually assign the advanced risk assessment roles to the sn_grc.business_user role. To understand how you can adjust granting of roles and groups, refer to see the How to adjust granting of roles and groups to use background jobs [KB0963693] article in the Now Support Knowledge Base.

    The questions that a risk assessor answers are configured in the RAM. An assessment can contain manual factors and automated factors. Manual factors need human input as responses. For automated factors, the responses are automatically calculated. Automated factors are automatically executed based on the schedule that is defined in their configuration.

    After an assessment is completed, then based on the defined reassessment frequency, a reassessment is automatically triggered. A reassessment is triggered only if the existing risk assessment instance is in the Monitor state. If an assessment is in the Monitor state, then whenever automated factors run according to their schedule, the assessment scores will change and the factors will contribute new scores to the rollup.

    If the risk assessor determines that an assessment must be reassigned to another relevant assessor, then the assessor can reassign the assessment. The assessor can also modify the responses after responding to the factors.

    If an assessment is taken more than once, and if the option to copy the previous assessment responses is enabled in the RAM, then the responses from the previous assessments get automatically copied to the current assessment.
    Note:
    Automated factor responses and overridden scores aren’t copied from previous assessments.

    Components of a risk assessment instance

    Based on the configurations in the RAM, the risk assessment instance form also displays the following related lists:
    • Previous Assessments: The previous five assessments for the risk that is currently being assessed.
    • Risk Events: The number of risk events that are associated with the risk.
    • Risk Indicators: The number of risk indicators that passed and failed for this risk.
    • Open Issues: The number of open issues for the risk and their state and owners.
    • Risk Response Tasks: The number of risk response tasks that are created for the assessment.
    • Related controls: The controls that are related to the risk. This related list appears only when the control environment is being assessed.
      Note:
      Customers on previous releases might not be able to see the updated count for passed and failed indicators. To resolve this issue, run the Update indicator and Controls Count fix script.

    An assessor has the option to not assess the mitigating controls. The option to opt out of controls is useful in cases where there is a risk but there are no controls to mitigate it. For example, consider a scenario where a pandemic is a risk but there are no vaccines to control it. In such a case, the risk is assessed but the controls can be left out of the assessment. When an assessor decides to opt out of assessing mitigating controls and residual risks, the score is set to Not applicable.

    If the control assessment is configured to assess individual controls, and the controls are associated with the risk being assessed, then the option to opt out of controls does not appear. This happens because the controls are defaulted.

    If the residual assessment is for inherent risks and controls, and if the risk assessor opts out of control assessment, then the residual risks are not applicable. This condition is created because if there are no controls, that automatically means there are only inherent risks and no residual risks.

    Stages of risk assessment

    The risk assessment life cycle goes through the following states:
    1. Ready to assess: A new assessment instance is created.
    2. Inherent assessment: The inherent risk assessment is performed.
    3. Control assessment: The control assessment is performed.
    4. Residual assessment: The residual risk assessment is performed.
    5. Target assessment: The target risk assessment is performed.
    6. Respond: You respond to the risks.
    7. Awaiting approval: The risk assessment is awaiting approval from the approvers if they have been identified.
    8. Monitor: The risk assessment is complete and is being monitored.