---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# AI reviewer assist for risk assessments

# AI reviewer assist for risk assessments {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of AI Reviewer Assist for Risk Assessments

AI Reviewer Assist for Risk Assessments helps risk and compliance analysts efficiently review assessment tasks by providing AI-generated recommendations of relevant control objectives and risk statements from the compliance library.
These recommendations are automatically scoped to the AI Asset when accepted, reducing the manual effort involved in mapping controls and risks, especially for assessments using custom templates or questionnaires.
Show full answer Show less  
When an assessment task enters the Review state, reviewers can trigger AI skills that analyze completed responses and processing activities to suggest applicable controls and risks. Reviewers can accept, dismiss, or revert these recommendations within the assessment task.

## Key Benefits

* **Reduces manual effort:** Automatically identifies relevant control objectives and risk statements based on assessment responses without requiring preconfigured automation rules.
* **Supports custom templates:** Works with smart assessment templates, including custom ones, enabling flexibility across diverse assessment configurations.
* **Provides AI suggestion guides:** Explains the rationale behind each recommendation by referencing the specific assessment response or record detail that triggered it.

## How Recommendations Are Generated

Two AI skills power the recommendations:

* **Control Objective Recommender:** Identifies matching control objectives from the compliance policy statement library.
* **Risk Statement Recommender:** Identifies matching risk statements from the risk definition library.

These skills use retrieval-augmented generation (RAG) to search the compliance library for semantically similar records based on contextual data such as processing activity details and completed assessment responses. Language models then reason over candidates to finalize a non-duplicative list of recommendations. Records already in scope through manual or automated means are excluded.

## Using Recommendations in the Assessment Task

In the Review state, a prompt enables reviewers to generate AI recommendations, which appear in a dedicated Recommendations tab. Recommendations are presented separately for control objectives and risk statements with options to accept, dismiss, or revert each item. Accepted recommendations automatically populate the Applicable scope tab.

The Applicable scope tab consolidates applicable controls and risks from three sources:

* **Automation:** Items added by configured automation rules.
* **AI-assisted:** Items accepted from AI recommendations.
* **Manual:** Items manually added by reviewers.

Reviewers retain the ability to add or remove items from the Applicable scope irrespective of how they were added.

## Role Requirements

To generate and manage AI recommendations, users require specific roles:

* **snaircgenai.aircaiagentuser and snaircgenai.aircaiuser:** Enable generation and viewing of AI recommendations.
* **sngrcaigov.airiskandcomplianceanalyst:** Allows access to assigned risk assessment tasks in the AI Risk and Compliance workspace and management of AI recommendations.

This feature streamlines and enhances the accuracy of risk assessment reviews by leveraging AI to align assessment responses with relevant compliance controls and risks, ultimately saving time and improving governance outcomes.  
AI Risk and Compliance analysts reviewing assessments can review AI-assisted recommendations and assign relevant control objectives and risk statements from the compliance library. Accepted recommendations are scoped
automatically to the AI Asset.

## Overview of AI recommendations in risk assessments {#ai-based-reviewer-assistant-for-assessments__section_overview}

Control objectives and risk statements can be mapped to assessment responses through automation rules configured directly in smart assessment templates. However, these rules are tied to specific templates and control objectives
shipped with the product. This translates to manual effort for organizations using custom templates, custom questionnaires, or their own authority documents as the configuration have to be mapped manually.

AI-assisted recommendations spare this effort. When an assessment task moves to the Review state, a reviewer can trigger the recommendation skills to analyze the completed assessment responses and the associated processing activity.
The skills identify relevant control objectives and risk statements from the compliance library that the reviewer can either accept or dismiss.

When a reviewer accepts a recommendation, the control objective or risk statement is added to the Applicable scope tab on the assessment task. After the reviewer closes the assessment task, the corresponding
controls and risks for the items in Applicable scope are automatically scoped to the AI Asset.

## Key benefits {#ai-based-reviewer-assistant-for-assessments__section_benefits}

AI-assisted recommendations provide the following benefits:

* Reduces manual effort by automatically identifying relevant control objectives and risk statements from the compliance library based on assessment responses.
* Supports assessments built on smart assessment templates, including custom templates and questionnaires, without requiring preconfigured automation rules.
* Provides an AI suggestion guide for each recommendation that explains why the item was recommended, citing the specific assessment response or record detail that triggered it.
{#ai-based-reviewer-assistant-for-assessments__ul_o2q_yx5_3kc}

## How recommendations are generated {#ai-based-reviewer-assistant-for-assessments__section_how_it_works}

The following skills discover the relevant risk-controls for further governance evaluation:

Control Objective Recommender
:   Surfaces matching control objectives from the compliance policy statement library (sn_compliance_policy_statement).

Risk Statement Recommender
: Surfaces matching risk statements from the risk definition library (sn_risk_definition).  
Each skill retrieves candidate records from an existing compliance library using retrieval-augmented generation (RAG), then uses a language model to reason over the retrieved candidates and finalize a de-duplicated list.  
Note:  
A control objective or risk statement that's already in scope through manual addition or automation rules, isn't recommended.

The RAG approach matches assessment content against the compliance library. Here's how the skills generate recommendations.

1. Context is gathered from the following sources:
   * Processing activity details, such as name and description.
   * Completed smart assessment responses, including information objects, data subject types and hierarchy.
   * AI Asset, AI Asset Task, and AI Assessment Response.

   {#ai-based-reviewer-assistant-for-assessments__ul_rnj_zlz_3kc}  
   Note:  
   Excluded from the context are attachments, commentary notes, and AI Asset relationships
2. Based on context, short retrieval texts are generated that represent distinct risk obligations.
3. Each retrieval text is used to query the compliance library for semantically similar control objectives or risk statements.
4. The retrieved candidates are evaluated, and the most relevant items are selected and displayed in the Recommendations tab of a risk assessment task.
{#ai-based-reviewer-assistant-for-assessments__ol_m13_3y5_3kc}

## Role requirements to generate recommendations {#ai-based-reviewer-assistant-for-assessments__section_e5d_n43_jkc}

{#ai-based-reviewer-assistant-for-assessments__table_tc3_443_jkc__entry__2}

| Role | Description |
|-|-|
| 1. sn_airc_gen_ai.airc_ai_agent_user 2. sn_airc_gen_ai.airc_ai_user | Enables risk and compliance analysts to generate AI recommendations and view them in the Recommendations tab. |
| sn_grc_ai_gov.ai_risk_and_compliance_analyst | Enables risk and compliance analysts to access the assigned risk assessment task from the [AI Risk and Compliance workspace](https://www.servicenow.com/docs/GWra97fbuMSeap4RZObPLQ "The AI Risk and Compliance workspace is the central hub for AI risk and compliance managers to monitor risk posture, track assessments, manage controls and issues, and oversee AI cases across the enterprise."), and accept, dismiss, or revert AI recommendations on the assessment. |
[ ]

{#ai-based-reviewer-assistant-for-assessments__table_tc3_443_jkc}

## Recommendations tab in the Assessment Task record {#ai-based-reviewer-assistant-for-assessments__section_where_recommendations_appear}

On the Overview tab of a Assessment Task in the Review state, a banner prompts the reviewer to generate recommendations.
Selecting Recommend opens the Recommendations tab, which lists the recommended records on separate Control objectives and Risk Statements tabs. For details about what each recommendation card displays
If there's no relevant data available, the recommendations page indicates that the request was completed and there are no recommendations currently available. If the request is in progress, try reloading the page after some time.

Each
recommendation card in the New state displays the option to accept and dismiss it. After a reviewer accepts or dismisses a recommendation, the card displays the state as Accepted or Dismissed and offers a Revert
option to reset the state. Accepted recommendations automatically reflect in the Applicable scope tab on the assessment task record.

For details about what each recommendation card displays, see.

## Applicable scope tab in a risk assessment task {#ai-based-reviewer-assistant-for-assessments__section_ny3_ydv_3kc}

The Applicable scope tab lists all the records that apply to the processing activity. Items in this tab originate from three sources, identified by the Mode column.{#ai-based-reviewer-assistant-for-assessments__table_gwv_hbv_3kc__entry__2}

| Mode | Description |
|-|-|
| Automation | Items added by smart assessment automation rules configured in the assessment template. |
| AI-assisted | Items accepted from the Recommendations tab. |
| Manual | Items added manually by the privacy analyst during review. |
[ ]

{#ai-based-reviewer-assistant-for-assessments__table_gwv_hbv_3kc}

Reviewers can add and remove items from Applicable scope regardless of how they originated, including items from automation rules or accepted AI recommendations.