---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# AI risk score calculation

# AI risk score calculation reference {#ariaid-title1}

Release version: Australia  
Updated October 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of AI risk score calculation reference

This reference explains how ServiceNow calculates AI risk scores using the Risk Assessment Methodology (RAM) specifically designed for AI inventory.
It details the formulas, rating scales, control effectiveness calculations, rollup methods, and key settings that determine inherent, control effectiveness, and residual risk ratings for AI systems, models, and datasets represented as AI system entities.
Show full answer Show less  

## Key Features

* **Risk Score Formulas:** Inherent risk score is the average of Impact and Likelihood scores. Control effectiveness percentage is calculated based on the weighted compliance of controls and rounded to a whole number.
* **Rating Scales:** Impact and Likelihood use four-level rating scales with numerical scores (1 to 10) but different labels. Impact factors include six weighted subfactors such as financial and reputational impact.
* **Control Effectiveness Bands:** Scores less than 60% are Ineffective, 60--99% Need Improvement, and 100% Effective, each mapped to a rating value.
* **Rollup Method:** The AI system risk score is the average of all contributing risk scores from its related entities, excluding retired or canceled systems and audit entries. Rollup uses average for scores and maximum for annual loss expectancy.
* **Primary RAM Selection:** The primary RAM for AI systems is determined by a system property or alphabetical order if the property is empty or invalid, ensuring consistent risk evaluation.
* **Assessed Classifications:** Predefined RAMs produce assessed classifications (Low, Medium, High, Critical) based on score thresholds, applicable to AI systems, models, and datasets.
* **Impact Subfactors:** Impact score is a weighted average of six subfactors, including regulatory scrutiny and operational impact, mapped to discrete impact scores.

## Practical Implications for ServiceNow Customers

* Use this methodology to consistently assess and rate AI risks across your AI inventory, facilitating compliance and governance.
* Understand how control compliance affects your AI risk ratings, enabling targeted improvements in controls to reduce residual risk.
* Leverage rollup settings to aggregate risk assessments from AI components for a holistic AI system risk view.
* Configure the primary RAM property to control which risk methodology applies to your AI systems if multiple RAMs exist.
* Apply assessed classifications to prioritize risk mitigation efforts based on standardized rating bands.  
Formulas, rating bands, lookup matrix, and rollup settings that determine the inherent, control effectiveness, and residual ratings of an AI system.

## Formulas {#gov-airc-ref-risk-score-calculation__section_formulas}

The risk assessment methodology (RAM) named Risk assessment for AI inventory uses the following formulas for each risk.

    Inherent score = Average(Impact, Likelihood)
    Control effectiveness % = (sum of weights of compliant controls ÷ sum of weights of compliant and non-compliant controls) × 100

The Impact and Likelihood factors use the same four score values, but different rating labels.  
{#gov-airc-ref-risk-score-calculation__table_impact_scale__entry__2}

| Rating | Score |
|-|-|
| Low | 1 |
| Medium | 4 |
| High | 7 |
| Critical | 10 |
[Table 1. Impact scale]

{#gov-airc-ref-risk-score-calculation__table_impact_scale}  
{#gov-airc-ref-risk-score-calculation__table_likelihood_scale_ram0503__entry__2}

| Rating | Score |
|-|-|
| Unlikely | 1 |
| Likely | 4 |
| Highly likely | 7 |
| Almost certain | 10 |
[Table 2. Likelihood scale]

{#gov-airc-ref-risk-score-calculation__table_likelihood_scale_ram0503}

The control effectiveness calculation uses only active controls with a status of Compliant or Non-compliant, weighted by the control weighting value. The result is rounded to a whole number. If the risk has no such controls, the
result is 0.

The rollup combines the scores of the contributing risks into one score for the AI system.

    AI system score = Average(score of each contributing risk)
    AI system rating = rating band of the AI system score

Note:  
The tables and formulas use "AI system" terminology throughout, matching the underlying table and field names. The same rollup, primary RAM, and formulas apply to AI models and datasets, because every AI digital asset is
represented by the same AI system entity map record regardless of asset type.

## Inherent rating bands {#gov-airc-ref-risk-score-calculation__section_inherent_bands}

{#gov-airc-ref-risk-score-calculation__table_inherent_bands__entry__3}

| Rating | Lower limit of band | Rating value |
|-|-|-|
| Low | 0 | 1 |
| Medium | 4 | 4 |
| High | 7 | 7 |
[Table 3. Inherent rating bands]

{#gov-airc-ref-risk-score-calculation__table_inherent_bands}

## Control effectiveness rating bands {#gov-airc-ref-risk-score-calculation__section_control_bands}

{#gov-airc-ref-risk-score-calculation__table_control_bands__entry__4}

| Control effectiveness % | Level | Rating | Rating value |
|-|-|-|-|
| Less than 60 | 0 | Ineffective | 1 |
| 60 to 99 | 1 | Needs improvement | 4 |
| 100 | 2 | Effective | 7 |
[Table 4. Control effectiveness percentage to rating]

{#gov-airc-ref-risk-score-calculation__table_control_bands}

## Primary RAM requirements {#gov-airc-ref-risk-score-calculation__section_primary_ram}

The following table lists the requirements for a risk-based RAM to be the primary RAM of an AI system.  
{#gov-airc-ref-risk-score-calculation__table_primary_ram__entry__2}

| Requirement | Value |
|-|-|
| State | Published |
| Assessed on | Risks |
| Domain | AI risk and compliance |
[Table 5. Primary RAM requirements]

{#gov-airc-ref-risk-score-calculation__table_primary_ram}

The default primary RAM is selected in the following order.

1. The RAM in the sn_grc_ai_gov.aisystem_primary_ram property, when more than one eligible RAM exists and the RAM is eligible. If the property value isn't eligible, no default RAM is set.
2. The first eligible RAM in alphabetical order by name, when the property is empty or only one eligible RAM exists.
{#gov-airc-ref-risk-score-calculation__ol_primary_ram_order}

## Rollup inputs {#gov-airc-ref-risk-score-calculation__section_inputs}

The following table lists what contributes to the AI system rollup.  
{#gov-airc-ref-risk-score-calculation__table_inputs__entry__2}

| Input | Rule |
|-|-|
| Related entities | Active entities in the AI system entity map whose primary RAM matches the primary RAM of the AI system, excluding third-line audit entries |
| Risks | All risks of the contributing entities, excluding third-line audit entries |
| Risk assessments | Active assessments on the contributing entities that use the primary RAM and are in the Monitor state |
| AI systems | All AI systems except those in the Retired or Canceled state |
[Table 6. Inputs to the AI system rollup]

{#gov-airc-ref-risk-score-calculation__table_inputs}

## Rollup settings {#gov-airc-ref-risk-score-calculation__section_rollup_settings}

{#gov-airc-ref-risk-score-calculation__table_rollup_settings__entry__2}

| Setting | Value |
|-|-|
| Score rollup | Average |
| Annual loss expectancy rollup | Maximum |
[Table 7. Rollup settings of the Risk assessment for AI inventory RAM]

{#gov-airc-ref-risk-score-calculation__table_rollup_settings}

## Rollup result stages {#gov-airc-ref-risk-score-calculation__section_stages}

{#gov-airc-ref-risk-score-calculation__table_stages__entry__2}

| Stage | Description |
|-|-|
| Needs update | Result flagged for recalculation after the primary RAM of the AI system is set or changed, or after a score-affecting change on a related entity that uses the primary RAM |
| Processing | Result picked up by a scheduled job that recalculates the scores |
| Updated | Result stored with the new ratings. A result flagged again during processing returns to Needs update. |
[Table 8. Rollup result stages]

{#gov-airc-ref-risk-score-calculation__table_stages}

## Properties {#gov-airc-ref-risk-score-calculation__section_properties}

{#gov-airc-ref-risk-score-calculation__table_properties__entry__2}

| Property | Purpose |
|-|-|
| sn_grc_ai_gov.aisystem_primary_ram | Default primary RAM for AI systems when more than one eligible RAM exists |
[Table 9. Risk score property]

{#gov-airc-ref-risk-score-calculation__table_properties}

## Assessed classification {#gov-airc-ref-risk-score-calculation__section_assessed_classification}

The following table lists the predefined RAMs that produce an assessed classification. Each RAM ships in the Draft state. Publish a RAM before you use it.  
{#gov-airc-ref-risk-score-calculation__table_assessed_rams__entry__3}

| RAM | Applies to | RAM selection |
|-|-|-|
| Risk classification for AI system | AI systems | Selected when the assessment starts |
| Risk classification for AI Model or Dataset | AI models and datasets | Selected when the assessment starts |
[Table 10. RAMs that produce an assessed classification]

{#gov-airc-ref-risk-score-calculation__table_assessed_rams}

Both RAMs use the following formula.

    Inherent score = Average(Impact score, Likelihood score)

The following table lists how each RAM converts the inherent score to a rating.  
{#gov-airc-ref-risk-score-calculation__table_assessed_bands__entry__3}

| Score | AI system | AI model or dataset |
|-|-|-|
| 0 to 5.00 | Low | Low |
| 5.01 to 7.00 | Medium | Medium |
| 7.01 to 9.00 | High | High |
| 9.01 to 10 | Unacceptable | Critical |
[Table 11. Assessed classification score-to-rating conversion]

{#gov-airc-ref-risk-score-calculation__table_assessed_bands}

The Impact factor is a weighted average of six subfactors. The following table lists each subfactor and its weight.  
{#gov-airc-ref-risk-score-calculation__table_impact_subfactors__entry__2}

| Subfactor | Weight |
|-|-|
| Regulatory scrutiny | 15% |
| Financial impact | 20% |
| Operational impact to the business | 20% |
| Regulation complexity | 20% |
| Number of businesses impacted | 10% |
| Reputational impact | 15% |
[Table 12. Impact subfactors and weights]

{#gov-airc-ref-risk-score-calculation__table_impact_subfactors}

The following table lists how the weighted average converts to the Impact score.  
{#gov-airc-ref-risk-score-calculation__table_impact_bands__entry__2}

| Weighted average | Impact score |
|-|-|
| 0 to 5.00 | 5 |
| 5.01 to 7.00 | 7 |
| 7.01 to 9.00 | 9 |
| 9.01 to 10 | 10 |
[Table 13. Impact weighted average to Impact score]

{#gov-airc-ref-risk-score-calculation__table_impact_bands}

The Likelihood factor uses a four-point scale. The following table lists each rating and its score.  
{#gov-airc-ref-risk-score-calculation__table_likelihood_scale__entry__2}

| Rating | Score |
|-|-|
| Rare | 1 |
| Possible | 7 |
| Likely | 9 |
| Immediate | 10 |
[Table 14. Likelihood scale]

{#gov-airc-ref-risk-score-calculation__table_likelihood_scale}