Add a risk intelligence score to risk data for a third party

You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating.

Before you begin

Role required: sn_vdr_risk_asmt.vendor_assessment_reviewer

About this task

You typically populate the risk intelligence scores table using an integration that you created or installed from the ServiceNow Store. This procedure describes the process of updating risk intelligence scores manually.

When you request a risk score for a third party, risk intelligence providers return the score at a URL that they specify. Follow this procedure to manually add the score and URL to your risk data for the third party.

Procedure

1. Navigate to All > Third-party Risk Management > Risk Intelligence Provider Setup > Scores.

   The Risk intelligence scores related list displays the list of current provider services and associated scores.

   

2. Select New, fill in the fields on the Risk intelligence score form, and then select Submit.

   This step adds the score and the URL where the provider returned the score to the data for the third party or engagement.

   When you enter a rating from a risk intelligence provider, the system normalizes the value to convert it to the appropriate TPRM rating. When you enter a score from a risk intelligence provider, the TPRM generates both a normalized rating and a normalized numerical score.

   Table 1. Risk intelligence score form

   Field	Description
   Provider	Unique name of the risk intelligence provider. The choice list is populated with the providers that you registered.
   Provider service	A name that is the concatenation of the risk intelligence provider name and the particular service that returned the risk data. You configured the service using the process specified in Set up a risk intelligence provider service.
   Third party	Third party that was scored by the provider.
   Request type	Level of analysis for the Score type that you defined for the service. For example, a provider might offer three request types for the Financial Risk score type: Level 1, Level 2, and Level 3. A "Level 3" report might return significantly more detailed information and might cost significantly more than a "Level 1" report.
   URL	URL of the site that the provider returned for the request. The site provides the rating or score and additional information from the provider.
   Raw rating / Raw score	Raw value returned by the provider in the specified URL.
   Normalized score	If you entered a numerical raw score from the provider, then this is the computed normalized TPRM score.
   Normalized rating	If you entered a numerical raw score or raw rating from the provider, then this is the computed normalized TPRM rating.
   Score generated on	Date and time that the score was added to this record. Note: This is not the date/time when the data was generated by the provider.

3. Optional: Add subfactor data to the risk data for the third party.
   Subfactor data is not validated or mapped to TPRM score/rating data, but is stored directly as you enter it.
   1. Navigate to All > Third-party Risk Management > Risk Intelligence Provider Setup > Subfactors and then select New.
   2. Fill in the form in the same way as you filled in the data for a score/rating.

      Table 2. Risk intelligence subfactors form

      Field	Description
      Provider	Unique name of the risk intelligence provider. The choice list is populated with the providers that you registered.
      Provider service	A name that is the concatenation of the risk intelligence provider name and the particular service that returned the risk data. You configured the service using the process specified in Set up a risk intelligence provider service.
      Name	Name of the subfactor.
      Third party	Third party that was scored by the provider.
      Score	Raw value returned by the provider. Note: You can enter numerical or alphabetic text in this field. The value is not validated.
      Created	Date and time that the score was added to this record. Note: This is not the date and time when the data was generated by the provider.

Result

The data that you have associated with the third party now appears in reports. See Viewing risk intelligence scores for details. The data appears in the following locations:

• Risk intelligence scores related list as described in this procedure.
• Risk overview tab in the workspace.
• Risk intelligence scores tab in the workspace.