How can we create a report showing all the downstream risks and controls from an Entity.

[Etienne Galea M]

Example of Entity hierarchy: Business Unit - Department - Business Process -> Risk

We would like to create a report on the Business Unit level showing all the downstream Risks which can link directly to the Business Unit or indirectly (e.g. Business Process), keeping in mind that a report cannot be grouped using a List field.

[Connor Levien]

The correct way to build a report showing all downstream risks and controls for an entity is to use the GRCProfilesLists script include util and specificly the function 

new sn_grc.GRCProfileLists().getDownstreamProfileIDs(**Parse Target Entity ID here**)

I would refer to the OOTB related lists like Downstream controls and Downstream risks to see how this works.

But fundamentally you would make a report either in UI Builder or the classic report build and use this function as javascript to pass the entity sys_id you want to report on into the function. This function takes the entity sys_id and returns an array of all the entity sys_ids that are downstream per the Entity hierarchy table.

This is actually available OOTB on the Entity Overview tab in the workspaces with reports like this for issues and controls prebuilt. 

[Christophe_E]

Hello Connor,

Thanks for your update! I will definitively use your way of doing it.

Regards,

Christophe

[Connor Levien]

Thanks Christophe, if this helps you solve your ask please mark the response as such so other users can see it.

Good luck configuring!

[Brent Sutton]

Hey @Connor Levien, 

Thanks so much for sharing the post! The GRCProfilesLists script include looks really promising, but I just wanted to double-check a few things to make sure I’m on the right track.

From what I understand, aside from the pre-built reports in the workspace, the only method ServiceNow recommends for reporting downstream risks and controls is for non-technical risk staff (who often work with classic reports) to manually find the entity sys_id and insert JavaScript into the report filter. Is that correct?

I checked out the related list examples, and they’re dynamic, as they have access to the parent’s current object. Unfortunately, this dynamic behavior doesn’t seem possible in classic reports. It seems like a dynamic filter option would be a great fit here if only it could take an "entity" reference as an input, but I don’t think that’s possible.

We have thousands of classic reports in need of this functionality, so I’m curious—since this post is a bit older, do you know if ServiceNow has come up with a more streamlined solution since then? We're about to upgrade to Yokohama, so it would be great to know if there's been any new development.

Thanks again for your help! Also, just as an FYI, in our instance, the GRCProfilesLists script include isn't client-callable from classic reports. You’d need to write a client-callable script include to handle this, then use the GRCProfilesLists utility. I hope this helps others who might be running into the same issue!

Thanks in advance,
Brent

[Connor Levien]

Hey @Brent Sutton 

If you want to make this easier for people to use in classic report building you can build a dynamic filter for use in the reports. Dynamic filters would be the way to go if you are wanting business users to make their own reports without needing to know about scripts and pasting the values in.

You can make dynamic filters apply on the entity table and you can set your own up but you will have to write some scripts. The OOTB script I mentioned wont work straight away, as it expects an entity ID, you can leverage the code to make your own. You could make a dynamic filter such as "Entities that roll up to my department" and take the logged in user's department and find the entity that applies to the record and filter it. Then this dynamic filter would appear in the classic report creation and dynamically filter it based on the user looking at the report.

https://www.servicenow.com/docs/bundle/xanadu-platform-user-interface/page/use/using-lists/task/t_Dy...

If you want to do this in a dashboard and let users select specific Entities you can refer to the "Operational Risk Management" dashboard in the Risk Management workspace but this does require the use of UI Builder as its a bit more advanced.