TPRM feasibility – combining two assessment scores into a final third-party risk tier

Mansor2
Tera Contributor

‎09-12-2026 06:41 PM

Hello experts, 

 

We are assessing the feasibility of the following use case in a ServiceNow TPRM sandbox:

  1. A Third-Party Risk Assessment produces an assessment score.
  2. A separate Contract Risk Assessment produces another score.
  3. ServiceNow combines both scores, based on defined weightings and thresholds, to determine one final third-party risk tier.

Could you please confirm:

  • Can this be achieved using out-of-the-box TPRM assessment, scoring and tiering configuration?
  • Can two separate assessment scores be used as inputs to calculate the final tier?
  • Would this require a custom business rule, decision table, flow or scripted calculation?
  • Can the final calculated tier be stored against the third party or engagement record?
  • What would be the recommended ServiceNow design for this use case?
0 Helpfuls
  • 893 Views
1 REPLY 1

sanjaygupta
Tera Guru

a week ago - last edited a week ago

Hi,

Based on the TPRM documentation, the weighted scoring is out of the box. The step that turns two separate scores into a single tier is not described as a standard capability, so plan a small configured automation for that step.

Your question What the documentation indicates
Can this be done fully out of the box?Partly. Scoring and tiering are both configurable, but a tier calculated from two assessment scores is not described as a built-in option.
Can two assessment scores feed one result?Yes for ratings. The scoring setup aggregates scores from multiple records and tables, with weights for each table, using MIN, MAX or AVG.
Is custom logic needed?Likely for the tier step. A Flow Designer flow or a decision table is the recommended way to apply your own weights and thresholds.
Can the tier be stored on the third party or engagement?Yes. The documentation says the tier is assigned to the third party, and tiering assessments also relate to engagements.
Recommended designUse the scoring setup for the weighted score, then a configured flow for the final tier.

The scoring setup controls how external risk assessment scores are aggregated to engagements and third parties. Component criteria set the weights, and scoring rules group third parties or engagements and assign those criteria. Tiering is a separate process, where response scores are averaged into a tiering score and mapped to risk tiers. The tier is assigned to the third party when the tiering assessment closes. A tier driven by a Third-Party Risk Assessment score plus a Contract Risk Assessment score is therefore a combination you build around the standard process. servicenowservicenow


To set it up:

  • Go to All > Third-party Risk Management > Scoring Setup and review the component criteria and third-party risk scoring rules.
  • Add both assessments as inputs, with the weights you want. The documentation lists engagement risk assessments among the supported components.
  • Open Assessment Setup and confirm the risk rating scale, since your thresholds depend on it.
  • Create a flow in Flow Designer that runs when each assessment completes. It should read both scores, apply your weights and thresholds, and set the final tier.
  • Write the result to the tier on the third party, and on the engagement if you tier at that level. Confirm the exact field names in your sandbox, as I could not verify them from the documentation.
  • Check that the flow’s result matches the tier assigned by the tiering assessment, so the two do not overwrite each other.

Behavior can differ between the classic assessment engine and the Smart Assessment Engine, which TPRM now supports, so confirm which one your sandbox uses before you build. Use an update set or scoped application for the flow, and test it in the sandbox with sample scores near each threshold.

Sources:

0 Helpfuls