Computed Risk Rating is not populating on Vendor record

[sush6]

Hi Team,

I have an issue with Computed risk rating on Vendor record.

Computed risk rating on Vendor record is not populating automatically once the vendor risk assessment is closed. It is calculating and populating on Vendor Risk Assessment, but same value is not getting copied to Vendor record. Please let me know where to check and how to resolve the issue.

Thanks,

Susmitha

[Community Alums]

Hi @sush6 ,

Relevant sentence : "For any vendor risk assessment for a vendor or engagement, the final rating for the assessment is calculated as the weighted average of the questionnaires and document requests within each vendor risk area"
Assessments are assigned a default scoring rule with just a single vendor risk area (Default) if none are configured. In this case, if we have not configured the exist scoring rule or created a new one with customised vendor risk area so all questionnaires/document request fall under a single vendor risk area (Default).
That means the assessment risk rating is calculated by just the average risk rating of all the questionnaire/document request (ignore vendor risk area). Because there is only one document request linked to the assessment. The risk rating of the assessment will be the same as the document request.

Scores for each individual vendor risk area gets calculated (average) => All those vendor risk area scores "rollup" to the assessment risk rating by using weighted average.
The only rule in this case is Default (with single vendor risk area Default)

The OOB with demo data has three scoring rules: Default, IT Vendor Scoring Rule, Strategic Partner Rule
- The assessment in OOB is using the IT Vendor Scoring Rule:
- This scoring rule is applied to all assessments that meet the vendor filter field
- Inside of the vendor form, you can see which scoring rule is being applied:
- This scoring rule uses 3 vendor risk areas: Reputational, Security, Financial
- The document request/questionnaire record that is linked to the assessment has a vendor risk area of Default
- Because Default does not match any of the vendor risk areas defined in the rule, the score is not part of the calculation and hence the rollup will not happen.

OOB Example showing the risk rating being updated because the questionnaire has a Vendor Risk Area of Security: https://<instancename>.service-now.com/nav_to.do?uri=%2Fsn_vdr_risk_asmt_assessment.do%3Fsys_id%3D4a6bc9fb1b9df09007d07733cd4bcb76

Resolution

Couple ways we can stop assessment from updating risk rating if you want to manual update. Most requires you to create a new Vendor Risk Area in Risk Area Definition module first
1)Use that new vendor risk area when creating a questionnaire template
2)Swap out the new risk area in the configuration inside of the Default scoring rule
3)Make that new Vendor Risk Area the default value for the vendor_risk_area field on questionnaire / document request template
4)Inside the OOB assessment form, there is field that says "override risk rating". Checking that, you are able to select the risk rating you desire outside of the calculation. You would need to add these fields back: override_risk_rating, overridden_risk_rating, justification

[sush6]

Hi @Community Alums ,

Thank you so much for your response. We have configured scoring rule and calculation is working fine and risk rating is populated on Vendor Risk Assessment. But the same risk rating is needed on Vendor record as well and it should automatically populate based on risk rating on VRA which is coming as empty on vendor record currently (please find below screenshot)

[Vichitra Gupta]

Please check the dictionary of this field. In the dictionary, calculated should be checked. I faced the similar issue in ARA. It got fixed with above steps.