Change management - Risk Assessment Weighted score - whats wrong?

[Nikola1]

Hello Community,

I have a very hard time understanding how the risk assessment in Change Management is working,

My client wants to use a weighted score method, i.e. some question will be more important than others. At first glance this fits perfectly with ServiceNow Risk Assessment. The documentation states “

“The assessment uses a weighted score approach for each question. The composite weighted score derived from the answer of the end user is used to calculate risk”

https://docs.servicenow.com/bundle/newyork-it-service-management/page/product/change-management/task...

However, my experience showed that the Assessment Score which is compared with the thresholds is a basic sum of all metrics values. So, no weight is being taken into account.

I looked at the script includes “ChangeRiskAsmt” and I see the function to calculate the score is as follows:

// adds all weighted scores to calculate the composite score

                calcAsmtScore: function(asmtInstanceId) {

                                var score = 0;

                                var ga = new GlideAggregate(this.ASMT_METRIC_RESULT);

                                ga.addActiveQuery();

                                ga.addAggregate("SUM", "actual_value");

                                ga.addQuery(this.INSTANCE, asmtInstanceId);

                                ga.addNotNullQuery("actual_value");

                                ga.addQuery("actual_value", ">=", "0");

                                ga.groupBy(this.INSTANCE);

                                ga.query();

                                if (ga.next())

                                                score = ga.getAggregate("SUM", "actual_value");

                                if (this._log.atLevel(global.GSLog.DEBUG))

                                                this._log.debug("[calcAsmtScore] score: " + score);

                                return score;

                },

I confirmed this by playing with the thresholds and indeed the Score is just a sum of all values. Which is not right.

To add to the confusion, I found this KB “KB0782241” which states

 “Risk value is calculated as score += actual_value * metric.weight; not just the sum of actual values. This is expected OOB behavior.”

So now I`m totally confused.

You probably noticed that the script sums the actual_value. So, I assumed that the actual_value might be the Value * Weight – but it is not. The actual value is equal to the Value of the metric definition

also mentioned here .

Does someone have any experience with this? Any help will be appreciated.

Regards,

[Michael Fry1]

Are you using the Best Practices - Risk Assessment plugin? Thinking no because I don't have that script includes in my NY instance.

[Nikola1]

Yes, Risk Assessment plugin (com.snc.change_management.risk_assessment)

My version is Madrid. 

[Michael Fry1]

That's the legacy risk assessment plugin. The latest version should be: com.snc.bestpractice.change_risk

[Nikola1]

This is for the Risk calculation

• Risk Calculator - uses conditions to set values. (com.snc.bestpractice.change_risk) [link]
• Risk Assessment - uses questionnaires to set values (com.snc.change_management.risk_assessment) [link]