How to validate that Target Risk Score is equal or lower than Residual Risk Score?

[Marius8]

Hello all, 

How can I validate that when performing a Risk assessment methodology to not allow submission if target risk score is greater than residual risk score? 

I have a Risk Assessment Methodology that is using only Residual Assessment and Target Assessment. They are both identically configured using the same Factors, assessment contribution is qualitative, and using a qualitative scoring logic script to calculate the score based on a matrix. 

Factors: Likelihood and Impact

The final score for Residual Assessment and Target Assessment can be: Low (0-16), Medium (16-31), High (31-46), Critical (46+)

I want to not allow assessment submission if final target score is greater than final residual score.

I have tried with an Before Update Business rule and OnSubmit Client script but it doesn't work properly. I didn't find anything OOTB for this topic. I believe there is only something OOTB for Residual score > Inherent score but couldn't replicate the logic.

Thank you!

[Vinod54]

Hello @Marius8 ,

You can extend OOTB Script Include RiskAssessmentValidationUtils  and the validateSingleRiskAssessment() function from RiskAssessmentValidationUtilsBase. 

Review this logic, build a similar custom function to have an additional validations that prevent assessment submission when your condition is met.

There exist a detailed community article on the same, i am linking it for your reference.

Customizing Risk Assessment Validations in ServiceNow GRC 

If my answer helps hit the Helpful and Accept As Solution buttons. 

Thanks,

Vinod Kumar M