RAM assessed and Residual Risk is populated, but Residual Score remains empty

mohdarbaz
Kilo Guru

3 weeks ago

Hi Community,

We are using Advanced Risk Assessments with a Risk Assessment Methodology (RAM).

After completing the assessment, the Residual risk field is populated correctly with values(PFA).
 

However, the separate Residual score field remains empty. The Inherent score and Calculated score fields also appear to remain empty.

Because these score fields are not updated, our heatmaps and other risk reports are not showing accurate results.

Could someone please clarify:

  • What is the difference between Residual risk and Residual score?
  • What is the relationship between RAM-generated assessment scores and these score fields?
  • Should the Residual score be updated automatically after completing the RAM assessment?
  • Which fields do the OOB Advanced Risk heatmaps and reports use? I see (residual risk score, inherent risk score, calculated risk score).
  • Is any additional configuration required to synchronize the RAM results with the Risk record score fields?

Screenshots are attached for reference.

 

#IRM #AdvancedRiskManagement

 

Regards,
Mohd Arbaz.

Preview file
97 KB
Preview file
75 KB
0 Helpfuls
  • 709 Views
2 REPLIES 2

mohdarbaz
Kilo Guru

3 weeks ago

Hi,

 

Do we need to configure/ change anything post migration from classic risk questionnaires to RAMs. AS reports are not getting generated based on RAMs calculated scores.

Need guidance on this.

0 Helpfuls

itsanupam81
ServiceNow Employee

2 weeks ago - last edited 2 weeks ago

Hi @mohdarbaz , Thanks for raising this on the ServiceNow community! I have reviewed the concern and the screenshots and I trust you have GRC: Advanced Risk migration app installed however you have not migrated to Advanced Risk Assessments. ServiceNow maintains compatibility with Risk Management post installation of Advanced Risk installation by default. For customers, who are ready to migrate over to Advanced Risk need to enable a system property 'Migrate to Advanced Risk Assessments' (sn_risk_advanced.hide_risk_legacy_lifecycle) (Note, this migration is oneway, once this property is turned on you cannot revert to classic risk assessments and legacy risk lifecycle).

 

Once turned on you will see different set of attributes revealing the scores on the Risk Assessment system of record, such as,  Final inherent score, Final control score, Final residual score - if you want to get access to the scores for the corresponding ratings.

 

Review this article for migration from Legacy risk to Advanced risk:

https://www.servicenow.com/community/grc-articles/migrating-to-grc-advanced-risk-from-legacy-risk/ta...

 

Responses:

  • What is the difference between Residual risk and Residual score? [r] Rating versus score, although the field is different which you will see post migration
  • What is the relationship between RAM-generated assessment scores and these score fields? [r] this field is from the classic risk assessment which will no longer be visible post the migration
  • Should the Residual score be updated automatically after completing the RAM assessment? [r] yes, it is stored in the different field as mentioned
  • Which fields do the OOB Advanced Risk heatmaps and reports use? I see (residual risk score, inherent risk score, calculated risk score). [r] they will use the new fields that come with GRC: Advanced risk only
  • Is any additional configuration required to synchronize the RAM results with the Risk record score fields? [r] synchronization is automatic. If you have defined scoring in your RAM configuration it will be applied

 

I would like to share with you some amazing resources that should be of huge help in your journey to adopt Advanced Risk

 

How to implement Risk / Advanced Risk - https://www.servicenow.com/community/grc-articles/irm-risk-management-gt-how-to-implement-it-in-your...

 

Resources from speed learning series -

Playlist link: https://www.youtube.com/playlist?list=PLkGSnjw5y2U6b715ElsIdqaw0B2xPtWTu

 

Hope this helps!