We had a workshop with a couple of Service-Now consultants. I thought I had an understanding of how the risk questionnaire and risk calculation worked. As we are now in internal workshops to hash out questions and weights, I feel like there is some confusion.
This is my understanding. Is it correct?
The users provided answers to a series of questions. Those answers are translated into a number. For question one, the answers may have values of 1, 2, and 3. For question two, the answers may have values of 1, 3, and 9.
Once the questionnaire is completed, and the CIs are included, a risk calculation is run. Various attributes of the CIs (and the change ticket) are used to weight the final score from the questionnaire. So if the assets have a criticality of B, maybe it is a 50% increase. So a risk questionnaire score of 10 goes to a 15. If the assets have a criticality of A, maybe it is a 100% increase, so a 10 becomes a 20.
The final number, after the weighting, is what is compared to cut-offs to determine if it is low, medium, or high risk.
It seems my understanding may be wrong. So far, I can only find this article. If my understanding is wrong, why? Why, on the worksheet we were given as a sample, are the risk calculation values given as a percentage? What if we have a complicated change on a non-production asset? Why should it be a high risk change?
