What is the difference between Risk Events and Issue on ServiceNow IRM.

[Sara Kiyono]

Hi Everybody,

Can some please help me with some clear examples explaining the difference between Risk Events and Issues. What are scenarios when we raise Risk Events and in which case we will raise Issues?

[Arun_Manoj · Accepted solution]

Hi @Sara ,

Reporting an Issue

An employee is reporting a known problem, gap, or failure in a policy, process, or control that needs to be addressed.

Example Scenarios:

• "Access logs are not being reviewed as required."

• "A system control failed and backup was not taken."

• "A third-party contractor violated a data policy."

• "We missed a compliance report deadline."

 What happens next:

• The report goes through issue triage.

• It’s assessed for severity, ownership, and remediation.

• It may become a Risk Issue, Compliance Issue, or Audit Issue in ServiceNow.

• Tracked to resolution with due dates and accountable owners.

Used when something is broken or non-compliant and needs to be fixed.

Reporting a Risk Event

An employee is reporting an incident, observation, or occurrence that could impact the organization’s risk profile — even if nothing has failed yet.

• "We received a suspicious email with a malicious link."

• "There was a 5-minute outage in our core banking system."

• "A regulator released a new rule affecting our operations."

• "Customer data was mistakenly emailed — no breach confirmed."

What happens next:

• The event is reviewed to assess its impact on existing risks or to identify new risks.

• It might lead to:

  • Re-evaluating risk scores

  • Creating new risk statements

  • Triggering a formal investigation

• In ServiceNow, it could be linked to existing risks or feed into risk assessments.

Used when something potentially risky occurs, even if no control has failed.

Thanks

Arun

[Sara Kiyono]

@Arun_Manoj 

Thanks for sharing the specific examples!!
Am I correct in understanding that a risk event is “an actual event that could happen if a risk materializes” and the issue is “something that should be corrected, such as a policy, process, or control”?

[SANDEEP DUTTA · Accepted solution]

Hi Sara,

Correct !!R isk Events are the actual Risk which could happen if a risk materializes.

Issues are either created automatically due to a control testing failure or any automated process as per the workflow and you can create issues manually as well to highlight there is a problem in the process in IRM.

In short, you have got it right in understanding.

[Dr Atul G- LNG]

@SANDEEP DUTTA any thoughts here?