(With Custom Questionnaires + Auto‑Calculated High/Moderate/Low Values)
Hi Developers! 👋
I recently implemented a requirement where Risk and Impact values must be automatically calculated based on responses to specific Risk and Impact Assessment Questionnaires. Once the user submits the assessment, the system computes a total score and maps it Risk and Impact field based on score range in Change[change_request] table:
- High
- Moderate
- Low
Since this is a common challenge across Change Management, GRC, and Custom Apps, I’m sharing a complete configuration guide that you can reuse.
Let’s get started! 🔧
🧩 Step 1: Install & Activate the Required Plugin
Navigate to:
System Definition → Plugins
Install and Enable:
Change Management - Risk Assessment
(com.snc.change_management.risk_assessment)
This plugin provides:- Assessment metric definitions
- Metric categories
- Questionnaire UI
- Weighted scoring framework
🧩 Step 2: Configure the Risk Assessment Definition
Navigate to:
Change → Administration → Risk Assessments → New
Create:
- Risk and Impact Assessment
- Table: The target table (example: change_request)
Add description, conditions and publish it.
Scroll down to related lists to follow Step 3
🧩 Step 3: Configure the Metric Category [asmt_metric_category]
Add description, conditions and submit it.
Scroll down to related lists
Scroll down to related lists
🧩 Step 4: Step 4: Add & Configure Assessment Metrics (Questions)[asmt_metric]
Create metrics (each metrics will define each question)
Create metrics (each metrics will define each question)
🧩 Step 5: Create Assessment Metric Definitions[asmt_metric_definition]
Create metric definitions for each of the metrics to add scores for each of the choices of a metric, which will be calculated (sum up) in later steps
🧩 Step 6: Use Risk Conditions + Script to Compute Impact Score:
Navigate to:
Change → Administration → Risk Assessments
Create Impact Assessment and check 'use script values'
Add the Script Values
Navigate to:
Change → Administration → Risk Assessments
Create Impact Assessment and check 'use script values'
Add the Script Values
var totalImpactScore = 0;
var normalized_value = 0;
gs.info('Starting impact calculation for Change Request: ' + current.number);
// Get the latest completed assessment for this Change Request
var assessmentGR = new GlideRecord('asmt_assessment_instance');
// assessmentGR.addQuery('source_table', 'change_request');
assessmentGR.addQuery('source_id', current.sys_id);
assessmentGR.addQuery('state', 'complete');
assessmentGR.orderByDesc('sys_created_on');
assessmentGR.setLimit(1);
assessmentGR.query();
if (assessmentGR.next()) {
var instanceId = assessmentGR.getUniqueValue('asmt_metric_result.instance');
// gs.info('Found assessment instance: ' + instanceId);
// Get individual metric results
var metricResultGR = new GlideRecord('asmt_metric_result');
metricResultGR.addQuery('instance', instanceId);
metricResultGR.query();
while (metricResultGR.next()) {
var metricName = metricResultGR.metric.name.toString();
normalized_value = parseFloat(metricResultGR.normalized_value);
// Only log values for specific questions
if (metricName == 'What is the scale of potential Impact' ||
metricName == 'Estimated Downtime (in minutes)' ||
metricName == 'Rollback Plan Tested' ||
metricName == 'Support Resources Available' ||
metricName == 'Compliance Implications' ||
metricName == 'External Stakeholder Impact' ||
metricName == 'Legal or Contractual Obligations' ||
metricName == 'Time Sensitive' ||
metricName == 'Training or Documentation Required' ||
metricName == 'Third-party Dependencies' ||
metricName == 'Communication Required' ||
metricName == 'Business Continuity Plan Reviewed') {
gs.info('Included Question: ' + metricName + ', Normalized Value: ' + normalized_value);
totalImpactScore += normalized_value;
gs.info('Included in impact score. Running total: ' + totalImpactScore);
}
}
gs.info('Total Impact Score: ' +totalImpactScore);
// Set Impact based on combined score
if (totalImpactScore > 18) {
current.impact = '1'; // High
gs.info('Impact set to High (1)');
} else if ((totalImpactScore >= 12) && (totalImpactScore <= 18)) {
current.impact = '2'; // Moderate
gs.info('Impact set to Moderate (2)');
} else {
current.impact = '3'; // Low
gs.info('Impact set to Low (3)');
}
} else {
// No assessment found — set default impact
current.impact = ''; // Moderate
gs.info('No assessment found. Default impact set to Moderate (2)');
}
answer = true;
🧩 Step 7: Create Business Rule to Compute Risk Score
Create a Business Rule:
- Table: change_request
- When: Before Update
- Condition: Type is Normal
- Script:
(function executeRule(current, previous /*null when async*/) {
if (current.approval.changes() || current.state.changes()) {
gs.info('BR: Skipping risk calculation because approval or state changed.');
return;
}
var totalRiskScore = 0;
var normalized_value = 0;
// current.setWorkflow(false);
// Always initialize risk to --None-- at start
current.risk = '';
gs.info('BR: Risk initialized to --None--');
// Set default message for risk impact analysis
// Get the latest completed assessment for this Change Request
var assessmentGR = new GlideRecord('asmt_assessment_instance');
assessmentGR.addQuery('source_table', 'change_request');
assessmentGR.addQuery('source_id', current.sys_id);
assessmentGR.addQuery('state', 'complete');
assessmentGR.orderByDesc('sys_created_on');
assessmentGR.setLimit(1);
assessmentGR.query();
if (assessmentGR.next()) {
var instanceId = assessmentGR.getValue('sys_id');
gs.info('BR: Found assessment instance: ' + instanceId);
// Get individual metric results
var metricResultGR = new GlideRecord('asmt_metric_result');
metricResultGR.addQuery('instance', instanceId);
metricResultGR.query();
while (metricResultGR.next()) {
var metricName = metricResultGR.metric.name.toString();
normalized_value = parseFloat(metricResultGR.normalized_value);
if (!isNaN(normalized_value)) {
if (metricName == 'Likelihood of Failure ?' ||
metricName == 'Potential Impact if Change Fails' ||
metricName == 'Affects Critical Services' ||
metricName == 'Has this type of change failed in the past?' ||
metricName == 'Known Risks or Dependencies') {
totalRiskScore += normalized_value;
}
}
}
gs.info('BR: Total Risk Score calculated: ' + totalRiskScore);
// Update risk only if we have valid score
if (totalRiskScore > 0) {
if (totalRiskScore > 10) {
current.risk = '2'; // High
gs.info('BR: Risk set to High (2)');
} else if ((totalRiskScore >= 6) && (totalRiskScore <=10)) {
current.risk = '3'; // Moderate
gs.info('BR: Risk set to Moderate (3)');
} else {
current.risk = '4'; // Low
gs.info('BR: Risk set to Low (4)');
}
} else {
current.risk = '';
gs.info('BR: No valid score found, risk remains --None--');
}
} else {
gs.info('BR: No assessment found, risk remains --None--');
}
})(current, previous);🧩 Step 8: Copy whole script from an existing script include [ChangeRiskAsmtSNCChange] and create a new one [RiskCalculatorForChange] and paste all in this script include.
This step will remove the OOB info message for Risk and impact Assessment, since our values will be based on assessment score range, we will create client script to add info message for same functionality in change form
This step will remove the OOB info message for Risk and impact Assessment, since our values will be based on assessment score range, we will create client script to add info message for same functionality in change form
And comment out the condition block as shown in the screenshot below
🧩 Step 9: Create onload Client Script to Display Values in Info Message
function onLoad() {
// Get the current type
var changeType = g_form.getValue('type'); // backend value of the 'Type' field
if (changeType == 'normal') {
// Get the current state
var state = g_form.getValue('state'); // backend value of 'state'field
// Check if state is New (-5) or Assess
if (state == '-5' || state == '-4') {
// Get Risk and Impact backend values
var risk = g_form.getValue('risk'); // Replace with your actual field name
var impact = g_form.getValue('impact'); // Replace with your actual field name
// Only proceed if both Risk and Impact are not empty
if (risk && impact) {
// Map Risk values with color (amber for Moderate)
var riskLabel = '';
if (risk == '2') {
riskLabel = "<span style='color:red;'>High</span>";
} else if (risk == '3') {
riskLabel = "<span style='color:red;'>Moderate</span>"; // Amber
} else if (risk == '4') {
riskLabel = "<span style='color:red;'>Low</span>";
} else {
riskLabel = 'Not Defined';
}
// Map Impact values with color (amber for Medium)
var impactLabel = '';
if (impact == '1') {
impactLabel = "<span style='color:red;'>1 - High</span>";
} else if (impact == '2') {
impactLabel = "<span style='color:red;'>2 - Medium</span>";
} else if (impact == '3') {
impactLabel = "<span style='color:red;'>3 - Low</span>";
} else {
impactLabel = 'Not Defined';
}
// Build dynamic message
var message = "Risk has been set to " + riskLabel + " and Impact has been set to " + impactLabel + ".";
// Display info message
g_form.addInfoMessage(message);
}
}
}
}This provides real‑time feedback to the user.
🧩 Step 10: Disable the OOB 'Calculate Risk' UI action and Rename 'Risk Assessment' UI action to 'Risk & Impact Assessment'.
That's all 🚀
Below are the actual screenshots for the Risk and Impact Assessment
🧩 Step 10: Disable the OOB 'Calculate Risk' UI action and Rename 'Risk Assessment' UI action to 'Risk & Impact Assessment'.
That's all 🚀
Below are the actual screenshots for the Risk and Impact Assessment
🎉 Conclusion
By combining Assessment Designer, weighted scoring, Business Rules, and UI scripts, you can build a powerful automated Risk & Impact evaluation framework.
This setup ensures:
- ✔️ Consistent scoring
- ✔️ Transparent decision‑making
- ✔️ Automated High/Moderate/Low calculation
- ✔️ Cleaner Change/Risk management processes
This configuration ensures a consistent, automated way to calculate and display Risk and Impact levels based on assessment scores, improving accuracy and decision‑making in your process.
Thanks & Regards,
Debashish Paul
