Including Risks from Multiple Entities in a Single Risk Assessment Project (RAP)

[Harsh Chitroda]

1. In order to include multiple risks within a single Risk Assessment Project in ServiceNow, do all the risks need to belong to the same entity?

2. Is there a way to include or pull risks from multiple entities into one Risk Assessment Project? Since, currently OOTB I can just choose one assessable entity 

Can someone please help? 

[kaushal_snow]

@Harsh Chitroda ,

You can only pick one assessable entity when you create the project, meaning all the risks you include must reference that same entity as the domain of assessment, the system does not natively allow pulling in risks from multiple disparate business entities into one RAP unless they share the same parent assessable entity context; however if you need to assess across multiple entities you can use a composite entity (for example one that groups different entity classes) via the assessable entity relationship so conceptually you can build something akin to a multi-entity RAP, but OOB the simpler RAP UI expects a single entity....

If you found my response helpful, please mark it as ‘Accept as Solution’ and ‘Helpful’. This helps other community members find the right answer more easily and supports the community.

[Ravi Gaurav]

Hi @Harsh Chitroda 
The system is designed around the idea that an assessment evaluates risk exposure for a single entity. Each assessable entity acts as a logical boundary for identifying and analyzing risks, controls, and responses. This helps maintain reporting accuracy and traceability, since the Risk Register, Assessment Methodologies, and Workbench views all reference a single entity.

Create Separate RAPs per Entity:
Create one Risk Assessment Project per entity and then roll up the results at a higher level (for example, via a custom dashboard, Performance Analytics, or Risk Overview report). This is the recommended approach and keeps alignment with the IRM data model.