Should Risk Statement aggregated scores recalculate based on Entity Based Access-visible risks?

[mohdarbaz]

Hello Community,

I am implementing Entity Based Access in ServiceNow IRM Advanced Risk and would like clarification about the expected behavior of Risk Statement aggregated risk scores after EBA restrictions are applied.

Configuration

• Advanced Risk Assessment is enabled and risk assessed using RAM.
• Risk records are created against L3 Risk Statements.
• Each Risk is associated with an Entity and an Owner.
• Entity Based Access is configured for the Risk record type.
• The following related records inherit the Risk EBA restriction:
  • Advanced Risk Assessment Instance
  • Assessment Instance
  • Risk Response Task
  • Risk Response Subtask
  • Indicator
  • Indicator Task
• The entity owner can now see only risks and assessment instances associated with the authorized entity.

Scenario:

A Risk Statement(PFA-see all 4 pics in sequence) has six risks across different entities:

Residual scores: 2, 1, 8, 4, 8, 3

The administrator sees all six risks and the 'Risk Statement aggregated residual rating' is average of all:

Moderate, Score 4.33

see 1 & 2 snips

After EBA(entity based access) is enabled, the 'Finance' entity owner sees only two Finance risks under the same Risk Statement as expected:

Residual scores: 8 and 4

However, the Aggregated risk related list still shows:

Moderate, Score 4.33

see 3 & 4 snips

The score is unchanged from the administrator view and appears to still include risks from all entities.

My questions are:

1. Is the Risk Statement aggregate intentionally calculated independently of EBA visibility?
2. Does EBA restrict only Risks and Assessment Instances, without recalculating the Risk Statement rollup?
3. Is there a supported method to calculate and display a Risk Statement aggregate using only the risks associated with the logged-in owner’s authorized entity?
4. I am looking for the supported out-of-box design rather than a custom rollup calculation. Is it right way to think?

Regards,

Mohd Arbaz.

#grc

#IRM

#advancedRiskManagement