---
sourceDocument: Yokohama Governance, Risk, and Compliance
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/governance-risk-compliance

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Third-party risk area criteria

# Define third-party risk area criteria {#ariaid-title1}

* Release version: Yokohama
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

A third-party risk area criteria is a group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party.

## Before you begin

Role required: sn_vdr_risk_asmt.vendor_risk_manager

## About this task

This is an example of the group of risk domains that you include in a risk area criteria that you might apply to IT service providers.  
Note:  
Risk domains are called "risk areas" in some platform applications.

## Procedure

1. Navigate to AllThird-party Risk ManagementScoring SetupRisk Domain Criteria.
2. Select New, enter a Name and Description, and then save the record.  
   The Third-party Risk Areas related list appears. In the following steps, you specify the risk areas to include in the risk area criteria.
3. On the Third-party Risk Areas related list, select Edit.
4. On the Edit Members page, select the third-party risk areas to add to the third-party risk area criteria record and then select Save.  
   * The selected third-party risk areas appear in the Third-party Risk Areas related list.
   * Scoring method and weight are copied from the risk areas.
   * You can adjust the weight of each risk area within a criteria definition.
   * You can override the values when needed.
   {#tprm-risk-domain-criteria-df__ul_qrg_j3h_4yb}
5. **Optional:** To edit Scoring method and Weight, select the name of a third-party risk area.  
   Important:  
   Changes to the scoring method and weight are used for the third-party risk area criteria record but aren't saved in the individual risk area definition records.

## Example

Assume you're creating a third-party risk area criteria with two risk areas: Financial and Security. Financial has a scoring method of Min Risk and a weight of 10.

* Your company is more concerned with security-related criteria, so the Security risk area has a scoring method of Average Risk and a weight of 20.
* The weights for both risk areas add up to 30. Resulting in the risk area with a weight of 10 calculating as 10/30 or roughly 33%.
* The risk area with a weight of 20 calculates as 20/30 or roughly 66%.
* If both risk areas had a weight of 10, they would each carry a weight of 50%.
{#tprm-risk-domain-criteria-df__ul_gnc_43h_4yb}

*[\>]: and then