How to enable calculation of Inherent and Calculated Risk Score at Entity level?

Prashant Ravi · ‎06-02-2020

Hi Everyone,

There are two read only fields for Entity table called "Inherent Score" and "Calculated Score". Is there any out of the box way to populate these fields automatically based on the scores of all Risks associated with this Entity?

Please refer to the screenshot below:

Community Alums · ‎06-02-2020

Hi Prashant,

That's part of Risk rollup in the advanced risk assessment, you need to have GRC: Advanced Risk plugin installed. As soon you install the plugin the property sn_risk_advanced.migrate_to_advanced_risk (https://xxx.service-now.com/nav_to.do?uri=sys_properties.do?sys_id=4d1ad68b73b50010ec95d11ee2f6a7b8) will set to true. This property is also available under Administration module.

In advanced risk assessment, risk scores are calculated across risk statement hierarchy, entity hierarchy, or a combination of both. These methods enable stakeholders to monitor their risk posture and provide visibility of the overall aggregated risk score.

Before you understand the rollup feature, consider the following points to:

Each entity might have multiple scores based on the different risk assessment methodologies.
Only the risk assessments in the Monitor state contribute to the risk score.
Each risk assessment methodology might have a different formula to calculate the rollup qualitative score and the rollup quantitative score. The formula is specified in the Rollup configurations section in the Risk Assessment Methodology form.

View solution in original post

UTKARSH JAIN · ‎06-03-2020

Hi Prashant,

Rafael is absolutely right. The values you want on the entity form are the aggregated risk results which are computed within the Advanced Risk application. I would strongly advocate to check that feature. Please let me know if you have any questions.

Rafael,

Thank you so much man. Looks like you have explored advanced risk assessments already. Loved it, would love to connect and get feedback from you.

Regards,

Utkarsh

Community Alums · ‎06-03-2020

I still don't consider myself a guru, but I am on the way - work in progress. It has many dependencies and these activities are quite time consuming. Yes, sure. It would be a pleasure to help you, more than happy to help make GRC better 🙂

Vanajan1 · ‎03-17-2021

Hello Everyone,

Advance apology if I am posting my query in the wrong place.

Is there a way I can add Control Effectiveness for each control so that user can manually set the score for each control as opposed to calculating the overall effectiveness for all controls.

In the image shown below, I would like to have another column next to the mitigation effectiveness so that user can manually enter the effectiveness for each control.

Thank You,