How to change the Inherent Risk Score calculation in Advanced Risk Assessment?

Shweta Kharb · ‎06-26-2020

Hi Team,

We are trying to use a custom scoring logic to calculate the Inherent Risk in Advanced Risk Assessment Instance. We understand it gets calculated from Impact & Likelihood factors. But tried to find out the relevant business rule but failed to do so.

We appreciate any help around where and how can we use our score instead of calculated inherent score coming from Factors.

Thanks

UTKARSH JAIN · ‎06-29-2020

Hi Shweta,

1. To launch Assessment based on UI Action "Assess Risk" do we need to script and create assessment instance? If yes, then how will select which RAM to pick as there can be multiple on one object or table?

Once a RAM is defined on the table on which you wish to perform an assessment, the system automatically creates the relationship. Therefore, for any object assessment you can only have 1 active RAM on that table. To initiate assessment you need to create UI action on that object and call the code in the document

The RAM is automatically selected based on the object

2. I am not able to find Risk Assessment related list in Entity Type table.

[Utkarsh] Since you may assess anything using this framework we do not preship any related list. However, you can establish that relationship very easily. Attaching a document which has some help towards that topic

3. We do not need to create scope like we used to do previously to assess Entities?

[Utkarsh] No you do not need to create scope for any object. You may directly assess the record in Any Object Assessment

Regards,

Utkarsh

View solution in original post

Eric Le Martre4 · ‎06-26-2020

Hi Shweta,

The logic in ARA is that everything is based on Factors, but you can create/invent all the factors you want and even grouped them in group factors. factors cam be scripted, if you want to set a specific logic.

For a Bank in Europe, I have set an ARA method where we use 6 non-financial manual factors grouped into a "non-financial Severity" group factor, using a "maximum calculation rule. Then I have another simple manual factor "Financial severity", I then take the maximum of these 2 to define the final inherent Impact score. I then have a basic Likelihood to go with it - see attached.

But you can be creative and add as many factors you need in the calculation.

Since last Friday, ServiceNow delivered a new ARA version including Automated Factors, similar to Risk Indicators, so that you can as well now include them into your calculations.

Best Regards

Eric

Shweta Kharb · ‎06-26-2020

Hey Eric,

Thanks a lot for Guidance!

Actually we have Inherent score coming from an assessment. That is the reason we are not calculating Inherent Risk at RAM level. We just need to populate the value of Inherent score which we already have with us.

But there are so many fields in the back end manipulating Inherent score that we are not able to track which one to update!!

UTKARSH JAIN · ‎06-29-2020

Hi Shweta,

As Eric highlighted the values in ARA comes from factors. These factors maybe automated or manual in nature. For your use case, it seems like Inherent Assessment will have single automated assessment factor which gets value from the your record. That is possible and you should be able to achieve it.

Regards,

Utkarsh

Shweta Kharb · ‎06-29-2020

Thanks Utkarsh, Guidance from your end means a lot!

We are happy to find Object level Risk Assessment with latest upgrade because we already configured something around these lines as we want to assess group of similar entities i.e Entity Type at one go.

i did saw the video where you are explaining new features and based on that I have defined a object level RAM with all three assessments.

Will you please help me understand:

1. To launch Assessment based on UI Action "Assess Risk" do we need to script and create assessment instance? If yes, then how will select which RAM to pick as there can be multiple on one object or table?

2. I am not able to find Risk Assessment related list in Entity Type table.

3. We do not need to create scope like we used to do previously to assess Entities?

Looking forward to hear from you..Thanks!