---
sourceDocument: Xanadu Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Manage risk events

# Manage risk events {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read

Risk events are potential or actual financial and non-financial losses, near misses,
and gains that occur within an organization. Risk events are also known as loss events or loss
entries.
To effectively manage risks, it's essential to monitor risk events. You must relate them to
existing risks, perform a root-cause analysis, and track the remedial tasks. Organizations
use risk events to understand their losses and to manage their risks more efficiently. Risk
events do not only lead to losses. At times, risk events also result in gains for an
organization. For example, in the banking industry, if there's an error in a trading
algorithm, it might result in a gain for an organization.

Any employee can report a risk event. After a risk event is reported, it is analyzed by the
risk manager.  
Risk events can be of two types:

Internal risk events
:   Events that occur within your organization.

External risk events
:   Events that occur in other organizations but are shared with the industry to ensure
that other organizations can prevent them.  
You can create a risk event using either the Service Portal or your ServiceNow instance. Risk events provide the following:

* Concrete data that enables you to better quantify and validate existing risks.
* Visibility into new risks because risk events often recur.
{#manage-risk-events__ul_qsh_yzh_f3b}

You can view the risk events dashboards by navigating to Risk EventsOverview.

For information on how to configure risk event integration in the Risk Workspace, see the [Risk event integration in workspace \[KB0966898\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB0966898) article in the Now Support Knowledge Base.
**Related concepts**   

* [Risk events life cycle](https://www.servicenow.com/docs/CZvTRJm7TsAgzFuKaHNPGA#lifecycle-of-risk-events "After a risk event is created, the event goes through a life cycle where risk managers analyze it and send it for approval.")

## Risk events life cycle {#ariaid-title2}

After a risk event is created, the event goes through a life cycle where risk managers
analyze it and send it for approval.  
The life cycle for risk events goes through the following stages:

1. Creating a risk event: A new event is reported by a business user. The event is pending validation by the event owner or risk manager who has the sn_risk.manager role.
2. Analyzing the risk event: The risk manager analyses if the event is legitimate and adds all the important information such as the event's loss entries, approvers, the root cause of the event, and the preventative and remedial action for the event. In this state, additional information can be requested from the event creator. You can then create an issue to ensure that similar events do not occur in the future. The issues are assigned to the respective issue owners who can then either accept the issue as is or create a remediation task.
3. Awaiting approval for the risk event: After all the data is entered and validated, the risk manager may request that the event be approved. The need for approval is determined by the loss threshold defined by the organization. For example, your organization may decide that if a risk event leads to a loss of $100000, then it must be approved by the senior risk management teams. Each event might go through several rounds of approval.
4. Approving, rejecting, or canceling a risk event: After the event is approved, the risk manager ensures that the issues created for the risk event are closed and that the root-cause analysis (RCA) is complete before the event is closed. At this stage, the approver can also choose to reject or cancel the event with adequate reasons.
5. Closing a risk event: After a user with the sn_risk.manager role is certain that the event has been captured and that the RCA has been completed, the event coordinator can close the risk event. If a risk event has open issues and tasks, then the risk event cannot be closed until the associated issues and tasks are closed.
{#lifecycle-of-risk-events__ol_gqw_jb3_f3b}  
The risk events workflow is summarized in the following figure:Figure 1. Risk events workflow
**Related tasks**   

* [Create a risk event in the Risk Workspace](https://www.servicenow.com/docs/daHT2~iOe33lxBJ864Ly2g "Create a risk event in the Risk Workspace. Risk events are potential or actual financial and non-financial losses, near misses, and gains that occur within an organization.")

## Relationship between risks, risk events, and risk statements {#ariaid-title3}

Relating risk events to risks and relating a risk statement to a risk is important for
all organizations that use the Risk Management application. Properties to enable these
relationships are provided under Risk Event Properties and Risk Management properties.

### Relationship of risk events to risk {#relate-risk-events-to-risk__section_ip5_3db_hjb}

Consider relating risk events to risks if you use the Risk Management application.
This relationship provides data for future risk assessment and is also useful for accurate
reporting. For example, if the management of an organization wants to know the total loss
incurred due to internal fraud, it can only be reported if all the risks are related to the
internal fraud risk event. To relate risks events to risk, set the Make risk event to risk relationship mandatory property to Yes. By default, this property is not turned
on.

### Relationship of risk statement to risk {#relate-risk-events-to-risk__section_vfg_bdb_hjb}

Consider relating each risk statement to a risk. Establishing this relationship prevents the
creation of orphan risks. An orphan risk is a risk that does not have a corresponding risk
statement associated with it. For example, if all the business units within an organization
understand the risk of employee attrition in different terms, it is difficult for the
organization to maintain comprehensive data on the risk of attrition. It is easier if the risk
statement of Employee Attrition is attributed to all events that relate to this risk.
Establishing the relationship between a risk statement and a risk is vital for correct reporting
and prevention. To relate risks to risk statements, set
sn_risk.risk_statement_mandatory to True.

### Add Basel categories to risk statements {#relate-risk-events-to-risk__section_mrt_5rk_3jb}

The Basel categorization is specific to the banking industry. This categorization helps customers comply with the Basel regulations by automating their loss event reporting. This particular setting enables the users to view the Basel Dashboards. The Basel Dashboard shows the number of loss events and net loss based on the Basel business lines and categories. Enabling this setting enables the users to view the Basel categorization tab where users can select one of the following Basel categories that apply.

* Internal fraud
* External fraud
* Employment practices and workplace safety
* Clients, products, and business practice
* Damage to physical assets
* Business disruption and system failures
* Execution, delivery, and process management

{#relate-risk-events-to-risk__ul_hyj_zrk_3jb}For more information, see [Properties installed with Advanced Risk](https://www.servicenow.com/docs/T4cH4qukOjoq2WRIlLyJaw "Properties are added with activation of GRC: Advanced Risk. There are also properties that are available for the various capabilities such as risk events and advanced risk assessments.") and [Properties installed with Risk Management](https://www.servicenow.com/docs/eUwNcFdkvtBB8HNCUokzFg "Properties are added with activation of GRC: Risk Management.")

To enable Basel categorization, set Show Basel attributes and reports to
Yes.

## Risk event response template {#ariaid-title4}

The risk event response template automates the process of adding approvers, issues, and
owners to a risk event. This automation is based on the conditions defined in the
template.  
The risk event response template provides these primary benefits:

* reduces the need for human handling of risk events during risk event creation.
* automatically defines the risk event life cycle and how users respond to that risk event.
* saves time with a predefined template.
{#risk-event-response-template__ul_q1z_3gb_1kb}For example, consider that a health and safety risk event has occurred. If the template is defined, the template can be used to assign the event to the person responsible for health and safety. The template facilitates the automatic assignment of risk events by enabling you to choose event types, entities, categories, and so on.

Users can define the threshold amount for risk event approvers. The threshold is defined based
on the risk appetite of the customers. For example, an organization decides that a risk event
resulting in a loss of $1000, does not need an approver. This threshold of $1000 can be defined
in the template. If the organization determines that any amount greater than $1000 dollars needs
approval, the template can automatically assign an approver.

You can define the template for any entity. All the child entities of the parent entity
inherit the rules defined in the risk event response templates. Defining a template saves the
time and effort required to define the rules for each entity separately.

For more information on how to set up risk event ingestion, see [KB0780985](https://support.servicenow.com/kb_view.do?sysparm_article=KB0780985) article in the Now Support Knowledge Base.

## Associate similar risk events {#ariaid-title5}

Train a similarity solution definition that uses machine learning by activating the Governance, Risk, and Compliance: Predictive Intelligence plugin. The solution enables the system to
display similar risk events automatically.

The Governance, Risk, and Compliance: Predictive Intelligence plugin uses Artificial
Intelligence (AI) and Machine Learning (ML) to manage the risk events more efficiently. You can
identify similar risk events and group them to capture and analyze the actual impact of the risk
event.

For example, in an organization with operations in multiple locations, the risk event teams
across different locations may be working on similar types of risk events. This challenge results
in duplicate efforts to manage the risk events within the organization. This capability reduces
the manual effort in managing similar risk events and improves overall organizational
efficiency.

You can associate similar risk events only when the main risk event is in the
Analyze state. Also, the Associate risk event button is unavailable for
similar risk events that are in the New or Rejected
state.

The platform machine learning administrator (ml_admin) can create a solution definition and
modify an existing one. You can navigate to Risk EventsAdministrationProperties to update the risk event property with the new solution definition name.

*[\>]: and then