--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Risk assessment methodologies # Risk assessment methodologies reference {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Risk assessment methodologies reference Risk assessment methodologies (RAMs) in the AI Risk and Compliance module provide frameworks to evaluate risks associated with AI assets, including AI systems, models, and datasets. These methodologies define scoring systems, classification criteria, and contributing factors essential for assessing and managing AI-related risks. Show full answer Show less By default, several RAMs are installed but remain inactive until reviewed and activated by administrators. Custom RAMs can be created to align with specific organizational requirements. Proper configuration of RAMs is critical as automated and advanced risk scoring depends heavily on them. To enable comprehensive risk score roll-ups across AI assets, ServiceNow customers must install the Advanced Risk application and enable the "Migrate to Advanced Risk Assessments" property, which is a one-way change. ## Key Features * **Risk Classification for AI Systems:** Classifies AI systems' regulatory risk levels based on intake or assessment data to inform early risk decisions. * **Automated Risk Classification for AI Systems:** Automatically assigns initial regulatory risk classifications based on responses in the Use and Purpose section of the intake form, supporting faster screening when enabled and properly configured. * **Risk Assessment for AI Inventory:** Calculates inherent and residual risk scores for AI systems, models, and datasets using likelihood, impact, and control effectiveness. Supports bulk risk assessments and aggregates individual scores for dashboard visibility and asset records. * **Risk Classification for AI Models or Datasets:** Provides risk classification based on data sensitivity and intended use, applied during governance evaluations specific to models or datasets. ## Practical Considerations * RAMs are inactive by default; implementers should review each methodology carefully before activation to ensure alignment with organizational policies. * Automated risk classification requires configuration by the AI Risk and Compliance administrator; otherwise, classifications default to "To Be Determined." * Risk assessments can be performed at different stages including intake screening, early assessment, and detailed asset-level evaluation. * Advanced risk scoring capabilities and roll-ups require enabling specific properties and installing related applications. ## What to Expect With properly configured RAMs, ServiceNow customers can systematically classify and score AI-related risks, enabling better governance, compliance, and informed decision-making. Aggregated risk scores provide visibility across AI assets, supporting ongoing risk management efforts within the platform's AI Risk and Compliance framework. Reference table listing the default risk assessment methodologies (RAMs) installed with AI Risk and Compliance. RAMs define the scoring frameworks, classification criteria, and contributing factors used to evaluate risks associated with AI assets. ## Risk assessment methodologies {#airc-rams-ref__section_rams} The following table lists the default risk assessment methodologies (RAMs) installed with AI Risk and Compliance. RAMs define the scoring frameworks, classification criteria, and contributing factors used to evaluate risks associated with AI assets. Administrators can create custom RAMs to meet organizational requirements. Important: Automated and advanced risk scoring behavior depends on RAM configuration. To enable risk score roll-up across AI assets, install the Advanced Risk application and enable the Migrate to Advanced Risk Assessments property. This is a one-way configuration change. RAMs are inactive by default. Implementers should review each RAM before activating it to confirm it meets organizational requirements. For more information, see [Set up Advanced Risk assessments properties](https://www.servicenow.com/docs/5V2EInNDWWLxCotcdM4k0g "Enable Advanced Risk Assessments (ARA) to confirm that risk‑based assessments and risk score roll‑up function correctly in the AI Risk and Compliance application.") and [Risk assessment methodologies](https://www.servicenow.com/docs/80vrGOfBZeOmYFHe0iJYeA "The AI Risk and Compliance application uses risk assessment methodologies (RAMs) to define the scoring frameworks and classification criteria used during risk assessments."). {#airc-rams-ref__table_rams__entry__4} | RAM | Applies to | Purpose | When used | |-|-|-|-| | Risk classification for AI system | AI systems | Classifies AI systems by regulatory risk level based on factors captured during intake or assessment. | During intake screening or early assessment to determine initial regulatory risk classification. | | Automated risk classification for AI system | AI systems | Automatically assigns an initial regulatory risk classification based on Use and Purpose responses. | During intake when automated screening is enabled. When configured and applied to the AI use case request form, this RAM evaluates responses in the Use and Purpose section and assigns a risk classification such as High, Medium, Low, or Unacceptable. If the AI Risk and Compliance admin doesn't complete the required configuration steps, the classification defaults to To Be Determined. | | Risk assessment for AI inventory | AI systems, models, datasets | Evaluates individual risks using likelihood, impact, and control effectiveness to calculate inherent and residual risk scores. | During asset-level and bulk risk assessment projects. Individual risk scores roll up to form an aggregated risk score visible on the AI asset record and the Risk and Compliance dashboard. This RAM is the default for bulk risk assessment projects. You can specify it as the default primary RAM using the `sn_grc_ai_gov.aisystem_primary_ram` property. | | Risk classification for AI model or dataset | AI models, datasets | Classifies models and datasets by risk level based on characteristics, data sensitivity, and intended use. | When models or datasets require independent governance evaluation. Unlike AI system classification RAMs, this RAM is not applied through a global property --- it is selected when initiating a risk assessment on an AI model or dataset. | [Table 1. Default risk assessment methodologies] {#airc-rams-ref__table_rams} **Related concepts** * [Risk assessment methodologies](https://www.servicenow.com/docs/80vrGOfBZeOmYFHe0iJYeA "The AI Risk and Compliance application uses risk assessment methodologies (RAMs) to define the scoring frameworks and classification criteria used during risk assessments.") **Related tasks** * [Set up Advanced Risk assessments properties](https://www.servicenow.com/docs/5V2EInNDWWLxCotcdM4k0g "Enable Advanced Risk Assessments (ARA) to confirm that risk‑based assessments and risk score roll‑up function correctly in the AI Risk and Compliance application.") **Related reference** * [Assessment templates reference](https://www.servicenow.com/docs/zWpKdAS5YXdGx_i8W2nVVA "Reference table listing the assessment templates installed with AI Risk and Compliance. Templates are delivered in Draft state and must be published before use.")