Define risk assessments

  • Release version: Australia
  • Updated March 12, 2026
  • 3 minutes to read

    • Change Management - Risk Assessment provides a flexible way to capture information from the end user to calculate the risk of the associated change request. You can define the risk assessment questions, thresholds, and conditions that calculate risk for any change request.

    Before you begin

    Role required: itil_admin

    Change Management - Risk Assessment must be activated.

    About this task

    You can use a series of questions to capture the risk of a change. A different assessment of the questionnaire can be defined on the change record. The assessment uses a weighted score approach for each question. The composite weighted score derived from the answer of the end user is used to calculate risk. This score is based on the thresholds associated with the risk assessment.

    Change Risk Assessment is an application built on Survey and Assessment V2 architecture. While it's possible to configure multiple metric categories on this architecture, it is better not to do so to avoid errors.

    You can configure multiple change Risk Assessment definitions each with one Metric Category, where the Metric Category filter is identical to the filter of the change Risk Assessment condition.

    Procedure

    1. Navigate to All > Change > Administration > Risk Assessments.
    2. Click New.
    3. Complete the form, as appropriate.
      Field Input value
      Name Name for the risk assessment. This name is displayed to the end user.
      State The state of the assessment: Draft or Published.
      Description Description of the risk assessment.
      Condition Conditions which determines if a risk assessment is attached to the change. Typically, the first attachment that matches the conditions gets attached during evaluation. Therefore, ensure that the conditions result in the correct assessments being attached especially when defining multiple questionnaires.
      Note:
      Ensure that the conditions are simple and mutually exclusive so that the assessment conditions are easy to understand and maintain.
    4. Click the form context menu and select Save.
      The page refreshes with the Assessment Categories and Assessment Thresholds related lists. The Assessment Categories related list enables you to define the questions that the end user answers to assess the risk of a change request.
    5. Complete the following steps to create an assessment question.
      1. In the Assessment Categories related list, click New.
      2. Complete the form, as appropriate.
        Table 1. Metric category
        Field Description
        Name Name of the assessment category.
        Create Stakeholders If selected, automatically creates stakeholders for all assessable records linked to this category.
        Weight Value that represents importance of this category relative to other categories. The weight is multiplied to the score of the answer to calculate the weighted score.
        Filter Only assessable records that meet filter conditions are evaluated by metrics in this category.
        Description Description of the assessment category.
      3. Click Submit.
      4. Open the assessment category.
      5. In the related list, click Assessment Metrics.
      6. Complete the form, as appropriate.
        Table 2. Assessment metrics
        Field Description
        Name Name of the assessment metric.
        Category The category of the assessment metric.
        Method The method of gathering data for this metric.
        Weight Value that represents importance of this metric relative to other metrics. The weight is multiplied to the score of the answer to calculate the weighted score.
        Order Order of the question in the assessment.
        Active If selected, the metric is activated to be used for assessments and result calculations.
        Mandatory If selected, makes a field mandatory in an assessment.
        General
        Question Question that is displayed on the assessment.
        Description Tool tip text for the assessment.
        Depends on The condition that determines whether the metric is shown to the user or not.
        Allow Additional Information If selected, a text box appears for the user to enter additional information for the question.
        Field Type
        Data type The data type of the answer that is given by a user for a question.
        Note:
        Depending on the data type that you select, additional fields may appear.
      7. Click Submit.
      8. In the Assessment Threshold related list, click New.
      9. Complete the form, as appropriate.
        Table 3. Change risk assessment threshold
        Field Description
        Risk Assessment The assessment name for which assessment threshold is applied.
        Risk Risk value applied on the change request.
        Note:
        Risk value can be overridden by risk conditions.
        Application The name of the application that contains the record.
        Score greater than The threshold against which the composite score is compared and evaluated.
      10. Click Submit.
      Note:
      You can create or edit the assessment questionnaire through the Assessment Designer module or by clicking Edit in Assessment Designer related link.
      For example, after you define the risk assessment, this is how the risk assessment score is calculated and set.
      • asmt_metric_result stores the score set.
      • The weight is calculated as sum (asmt_metric_result.normalized_value) where asmt_metric_result.normalized_value = actual_value * weight.
      • The risk calculated as sum(actual_value * weight) > threshold. For example, If the result is 7 and moderate threshold is 6 risk is moderate.