--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Risk assessment methodologies # Risk assessment methodologies {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Risk assessment methodologies The AI Risk and Compliance application in ServiceNow uses Risk Assessment Methodologies (RAMs) to define scoring frameworks and classification criteria for evaluating risks associated with AI assets. These RAMs are essential throughout the AI governance lifecycle, applied during intake, asset-level risk assessments, and bulk risk assessment projects to help classify and quantify risks effectively. Show full answer Show less ## Key Features * **Default RAMs:** The application provides default RAMs tailored for AI systems, models, and datasets. These RAMs classify AI assets by regulatory risk levels or evaluate risks through scoring based on likelihood, impact, and control effectiveness. * **Automated Risk Classification:** Enables automatic assignment of initial regulatory risk classifications during intake based on responses in the Use and Purpose section of the AI use case request form, streamlining early risk screening. * **Configurable Methodologies:** Administrators can customize RAMs to meet organizational needs and configure default RAMs for different AI asset types. Properties like `sngrcaigov.aisystemautomatedriskclassificationasmtram` and `sngrcaigov.aisystemprimaryram` control RAM assignments. * **Advanced Risk Integration:** Installing the Advanced Risk application enables risk score roll-up across AI assets and transitions assessments to an advanced risk framework, providing enhanced risk calculation and aggregation capabilities. This migration is permanent. * **Automated Risk Classification Workflow:** Integrates intake, assessment, and risk evaluation stages by reusing intake data to assign risk levels, apply assessment templates, and trigger post-assessment actions that generate risks and control objectives. Analysts validate these outputs before finalizing governance records. ## Practical Benefits for ServiceNow Customers * Enables consistent and automated classification and scoring of AI-related risks, enhancing regulatory compliance and governance efficiency. * Reduces duplicate data entry by carrying forward intake responses throughout the assessment lifecycle. * Supports specialized assessments for regulations such as the EU AI Act, ensuring comprehensive evaluation of AI systems. * Facilitates governance decision-making by providing quantitative risk scores and qualitative context aligned with AI lifecycle phases. * Allows customization of risk assessment frameworks to align with specific organizational risk policies and regulatory environments. ## Next Steps To fully leverage these methodologies, administrators should configure relevant RAM properties and consider installing the Advanced Risk application to enable risk score roll-up. It is important to understand that automated risk classification provides early risk context but does not replace detailed downstream impact or risk assessments required for AI system deployment decisions. The AI Risk and Compliance application uses risk assessment methodologies (RAMs) to define the scoring frameworks and classification criteria used during risk assessments. ## Risk assessment methodologies overview {#airc-rams__rams-overview} RAMs define the scoring frameworks and classification criteria used during risk assessments. ## Risk assessment methodologies {#airc-rams__risk-assessment-methodologies} Risk assessment methodologies (RAMs) define the scoring frameworks, classification criteria, and contributing factors used to evaluate risks associated with AI assets. RAMs are used during intake, asset-level risk assessments, and bulk risk assessment projects. The content pack provides default RAMs, and administrators can create custom RAMs to meet organizational requirements. {#airc-rams__risk-assessment-methodologies__entry__4} | RAM | Applies to | Purpose | When used | |-|-|-|-| | Risk classification for AI system | AI systems | Classifies AI systems by regulatory risk level based on factors captured during intake or assessment. | During intake screening or early assessment to determine initial regulatory risk classification. | | Automated risk classification for AI system | AI systems | Automatically assigns an initial regulatory risk classification based on Use and Purpose responses. | During intake when automated screening is enabled. When configured and applied to the AI use case request form, this RAM evaluates responses in the Use and Purpose section and assigns a risk classification such as High, Medium, Low, or Unacceptable. | | Risk assessment for AI inventory | AI systems, models, datasets | Evaluates individual risks using likelihood, impact, and control effectiveness to calculate inherent and residual risk scores. | During asset-level and bulk risk assessment projects. Individual risk scores roll up to form an aggregated risk score visible on the AI asset record and the Risk and Compliance dashboard. This RAM is the default for bulk risk assessment projects. You can also specify it as the default primary RAM for all risk assessments using the `sn_grc_ai_gov.aisystem_primary_ram` property. | | Risk classification for AI model or dataset | AI models, datasets | Classifies models and datasets by risk level based on characteristics, data sensitivity, and intended use. | When models or datasets require independent governance evaluation. Unlike AI system classification RAMs, this RAM isn't applied through a global property. It's selected when initiating a risk assessment on an AI model or dataset and evaluates characteristics such as data sensitivity, intended use, and associated risk factors. | [Table 1. Default risk assessment methodologies] For information about coordinating multiple risk assessments together, see [Risk assessment project in AI Risk and Compliance](https://www.servicenow.com/docs/5V2PrO7aqIBibVxX0bZQnw "You can perform assessments on multiple risks and controls simultaneously by creating a risk assessment project for an AI asset. This feature enables assessors to review multiple risks to understand their potential impact, likelihood, and associated mitigation strategies."). Important: Automated and advanced risk scoring behavior depends on RAM configuration. To enable risk score roll-up across AI assets, install the Advanced Risk application and migrate to Advanced Risk Assessments. This is a one-way configuration change. ## Risk assessment methodology configuration {#airc-rams__rams-business-configuration} Administrators can configure which risk assessment methodologies (RAMs) are applied during intake, assessment, and risk evaluation workflows. Configuration options include specifying default RAMs for AI systems, models, and datasets, and enabling automated or advanced risk calculation behavior. To configure automated risk classification during intake, specify the `sn_grc_ai_gov.ai_system_automated_risk_classification_asmt_ram` property. To define the default RAM used for risk assessments across AI systems, set the `sn_grc_ai_gov.aisystem_primary_ram` property. For more information, see [Set up AI Risk and Compliance properties](https://www.servicenow.com/docs/ZRUrlBRSI~Engipzdjzp~w "Configure AI Risk and Compliance properties to specify which authority documents and policies you want to display on the home page. You can also specify a default automated risk classification assessment RAM for AI systems and specify a default RAM to be used for risk assessments of AI systems."). Important: To enable risk score roll-up across AI assets, install the Advanced Risk application and set the Migrate to Advanced Risk Assessments property to Yes. This is a one-way configuration change that permanently transitions risk calculation and roll-up behavior to the Advanced Risk framework. See [Set up Advanced Risk assessments properties](https://www.servicenow.com/docs/5V2EInNDWWLxCotcdM4k0g "Enable Advanced Risk Assessments (ARA) to confirm that risk‑based assessments and risk score roll‑up function correctly in the AI Risk and Compliance application."). ## Automated risk classification workflow {#airc-rams__how-they-work-together} Automated Risk Classification connects intake screening, assessments, and risk evaluation into a single governance flow. Information captured during the intake request, specifically responses provided by the Product Owner in the Use and Purpose section, is reused across subsequent assessments and contributes directly to how AI systems are classified as High, Medium, or Low risk. Assessment templates, RAMs, and Post Assessment Actions work together to help ensure that qualitative context, regulatory impact, and quantitative risk scoring are consistently applied throughout the AI governance life cycle. A typical assessment sequence for an AI system demonstrates how these components are interconnected: 1. During intake, the Automated risk classification for AI system RAM evaluates responses captured in the Use and Purpose section of the AI use case request and assigns an initial regulatory risk classification. 2. During the Assess phase, the risk assessment captures information about the system's potential impact on privacy, fairness, and other fundamental rights. Responses from the Use and Purpose section are carried forward to provide continuity and reduce duplicate data entry. 3. Post Assessment Actions evaluate the risk assessment responses and automatically associate applicable risk statements and control objectives with the assessment record based on configured automation rules. 4. An AI Risk and Compliance analyst reviews the prescribed list of generated risks and control objectives to validate accuracy, relevance, and applicability before governance records are finalized. 5. After the assessment is marked as closed complete, the system generates risk and control records and maps them to the AI asset. The Risk assessment for AI inventory RAM then evaluates each identified risk using quantitative scoring to calculate inherent and residual risk scores. 6. For AI systems subject to the EU AI Act, additional assessments such as the EU AI Act Conformity Assessment and the Fundamental Rights Impact Assessment (FRIA) provide specialized regulatory evaluation. {#airc-rams__ol_b3m_tzk_gjc} Throughout this progression, assessment outcomes and risk scores inform governance decisions about whether an AI system can advance to the next life-cycle phase. For an overview of how these activities align with life-cycle stages, see [AI governance life cycle](https://www.servicenow.com/docs/NGgy5rh6vyahb~eJihuSOw "Learn more about how organizations can govern AI from initial demand through deployment and ongoing governance monitoring by using the AI Control Tower and AI Risk and Compliance applications together."). Note: Automated risk classification provides early risk context only. It doesn't approve deployment, initiate life-cycle workflows, or replace downstream impact or risk assessments.