Quantitative residual score based on Inherent and Control Assessments

Marek Remi_
Tera Expert

3 weeks ago

Hello community,

I am wondering if there is a possibility to calculate residual risk based on both inherent risk and control assessment, both qualitatively and quantitatively.

It looks like I am not able to define, using scripting, how the residual quantitative score should be mathematically influenced by the effectiveness of the control.

What I would like to achieve is the following:

  • Inherent risk score calculated as 1M EUR
  • Control effectiveness assessed as “Effective”

Based on this, I want to mathematically reflect how the effective control reduces the overall risk posture and the ALE calculated from the inherent risk.

At the moment, it seems that I can only influence the qualitative residual value, not the quantitative one.

Any thoughts or best practices on how to approach this?

Preview file
86 KB
0 Helpfuls
  • 411 Views
1 REPLY 1

itsanupam81
ServiceNow Employee

3 weeks ago

@Marek Remi_  Great question — this trips up a lot of people because the qualitative and quantitative residual paths look like one thing in the UI but are actually configured independently inside the RAM.

 

The short diagnosis

In Advanced Risk Assessment (ARA), the "calculation basis" you can pick on the Residual assessment type — Matrix, Inherent − Control, Inherent ÷ Control, or Custom formula — drives the qualitative residual rating. The quantitative Residual ALE is computed from its own quantitative factors (Residual ARO × Residual SLE), and there's no OOTB hook that auto-applies your Control Effectiveness rating to Inherent ALE the way the qualitative side does. That's why your script moves the rating but the €1M doesn't budge.

 

You can absolutely wire ALE to react to control effectiveness — it just has to be done deliberately, and (important) while the RAM assessment type is still in Draft. Once it's Published, you can't change the residual calculation logic on that same assessment type; you'd need to clone and re-publish.

 

Three patterns that work — pick one

1. Scripted automated factors on Residual ARO and Residual SLE (cleanest, what I'd recommend)

Make Residual SLE (and/or Residual ARO) an automated scripted factor that reads Inherent SLE plus the Computed Control Effectiveness rating and applies a reduction multiplier you define. Something like:

 
 
javascript
var inherentSLE = /* pull from inherent assessment instance */;
var ctrlEff   = /* computed_control_effectiveness from control assessment */;
var reduction = 0;
switch (ctrlEff) {
    case 'effective':           reduction = 0.80; break;
    case 'largely_effective':   reduction = 0.50; break;
    case 'partially_effective': reduction = 0.25; break;
    case 'ineffective':         reduction = 0.00; break;
}
answer = inherentSLE * (1 - reduction);

With your scenario — Inherent ALE €1M, control assessed as Effective at 80% loss reduction — Residual ALE lands at €200K. The qualitative residual stays configured independently via your chosen calculation basis.

2. Lookup matrix on the quantitative dimension

Same idea as the OOTB qualitative matrix, but applied to ALE. Build a reference table that maps (Inherent ALE band × Control Effectiveness rating) → a Residual ALE multiplier or band, and reference it from one scripted factor that writes Residual ALE. Nice when you want non-technical risk admins to own the reduction percentages without touching code.

3. Custom formula on the residual assessment type

Use the Custom Formula calculation basis and have the script set both the qualitative score and Residual ALE in one place — typically residual = inherent × (1 − control_effectiveness_pct) applied to both dimensions. Heavier coupling, but it keeps everything in one configuration artifact.

Two gotchas worth flagging up front

  • Draft-state constraint. Lock down your effectiveness → reduction mapping (Effective / Largely Effective / Partially Effective / Ineffective → % loss reduction) before you publish the RAM assessment type. Document it as part of your RAM design — getting it wrong post-publish means cloning the assessment type.
  • Controls must be mapped. If no controls are mapped to the risk, or the Control Effectiveness assessment hasn't been completed when Residual fires, the platform falls back to residual = inherent and your script silently does nothing. Worth a sanity check in your script.

 

Worked example for your scenario

Element Value How
Inherent ALE €1,000,000 Inherent ARO × Inherent SLE
Control Effectiveness Effective From Control assessment
Reduction mapping Effective = 80% Your script / lookup
Residual ALE €200,000 Scripted automated factor on Residual SLE
Residual qualitative rating e.g. "Low" Driven independently by Matrix / Subtract / Divide / Custom

 

Useful references

Hope this helps.

0 Helpfuls