--- sourceDocument: Australia Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences Release : - australia ft:locale : - en-US ft:publication_title : - Australia Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Risk rating calculation # Risk rating calculation {#ariaid-title1} Release version: Australia Updated October 5, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Risk rating calculation The AI Risk and Compliance feature in ServiceNow calculates risk ratings for AI systems by aggregating risk assessment scores from related AI assets such as AI models and datasets. This process provides inherent, control effectiveness, and residual risk ratings, enabling you to understand and manage AI-related risks comprehensively. Show full answer Show less Risk scores are computed in two stages: individual risk assessments for related entities, followed by aggregation via the Advanced Risk rollup engine into overall ratings for the AI system. This requires the Advanced Risk application to be installed and configured to migrate to advanced risk assessments. ## Key Features * **Risk Assessment Methodology (RAM):** Uses a predefined risk assessment methodology called "Risk assessment for AI inventory" applicable to all AI digital assets, ensuring consistent scoring across AI systems, models, and datasets. * **Score Types:** * **Inherent Risk:** Calculated based on assessor inputs on Impact and Likelihood factors. * **Control Effectiveness:** Automatically calculated from the status and weight of controls without assessor input, reflecting how well controls mitigate risks. * **Primary RAM Management:** Each AI system stores one primary RAM to apply during rollup. The system selects a default if none is set, but a published RAM must be assigned for rollup scores to appear. * **Aggregation Logic:** Rollup includes active related entities using the same primary RAM and excludes retired or canceled AI systems and third-line audit entries. It averages risk scores and converts them into rating bands, taking the maximum annual loss expectancy value. * **Scheduled Recalculation:** Risk scores update through scheduled jobs triggered by changes in primary RAM or related assessments, ensuring data consistency without immediate recalculation on each change. * **Visibility:** Ratings display on AI system records, Risk posture charts, and Risk heat maps, with options to view inherent or residual risk. You can also review which assessments contributed to each score. * **Assessed Classification:** Separate from automated ratings, this is an assessor-produced inherent risk classification based on Impact and Likelihood questions, applying different RAMs depending on the AI asset type. ## Practical Guidance for ServiceNow Customers * Ensure the Advanced Risk application is installed and the migration property set to use Advanced Risk Assessments to enable rating rollups. * Publish or create a custom RAM based on the predefined AI inventory RAM before running assessments to ensure scoring accuracy. * Assign a primary RAM to each AI system to produce rollup scores; otherwise, default RAM settings will apply. * Review control effectiveness ratings carefully, as automated calculations depend on up-to-date and compliant controls to reflect true risk mitigation. * Use the Risk posture charts and heat maps on AI system records to monitor overall risk levels and identify areas needing improvement. * Investigate and resolve any "No data found" errors on dashboards by following recommended troubleshooting for risk score and compliance score dashboard issues. ## Key Outcomes * Provides a unified and automated risk rating for AI systems that integrates inherent risk and control effectiveness assessments. * Enables consistent risk management across AI assets by applying a standardized RAM and rollup process. * Supports proactive risk monitoring with scheduled recalculations and comprehensive risk posture visualizations. * Helps identify compliance gaps in controls, facilitating targeted risk mitigation efforts. The inherent, control effectiveness, and residual ratings of an AI system come from risk assessment scores that a risk rollup aggregates. ## How the system calculates risk scores {#gov-airc-risk-score-calculation__section_calculation_stages} AI Risk and Compliance calculates the risk scores of an AI system in two stages. First, a risk assessment scores each risk that belongs to the related entities of the AI system. Second, the Advanced Risk rollup engine aggregates the scores of those risks into one inherent rating, one control effectiveness rating for the AI system. For how the rollup works in general, see [Risk score rollup in Advanced Risk Assessment](https://www.servicenow.com/docs/access?context=risk-rollup-ara-concept&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US). For the formulas, rating bands, and rollup settings, see [AI risk score calculation reference](https://www.servicenow.com/docs/yAKQZKNdgwSvs1wRg_I3MA "Formulas, rating bands, lookup matrix, and rollup settings that determine the inherent, control effectiveness, and residual ratings of an AI system."). Important: The rollup requires the Advanced Risk application. Install it and set the Migrate to Advanced Risk Assessments property to Yes before the inherent, control effectiveness ratings become available. This is a one-way configuration change. The predefined risk assessment methodology (RAM) named Risk assessment for AI inventory defines the scoring logic. It's a risk-based RAM with inherent, control assessments, and it applies to AI systems, AI models, and datasets alike: every AI digital asset is represented by the same underlying AI system entity map record regardless of its asset type, so the same rollup and primary RAM apply no matter which asset type you're viewing. It ships in the Draft state, so publish it or a custom RAM before you use it. Note: The aggregated inherent rating of an AI system is separate from its regulatory risk classification. The aggregated rating comes from the risk rollup. The classification comes from the classification RAM. For the classification, see [Classifying AI assets by regulatory risk](https://www.servicenow.com/docs/LeJWku~rbfOnMP_7k9JozA "Regulatory risk classification places an AI asset in a risk rating, such as Low or High, based on the score from a risk assessment."). ## Score types {#gov-airc-risk-score-calculation__section_score_types} Each risk is scored before the rollup. Inherent risk : Risk level before controls are considered, based on the inherent assessments of the contributing risks. For each risk, an assessor answers two choice factors, Impact and Likelihood. The score of each factor is the value of the option that the assessor selects, and the inherent score is the average of the two factor scores. Control effectiveness : Measure of how well the controls address the risks, based on the control assessments of the contributing risks. For each risk, the system calculates the score from the status and weight of its controls. No assessor input is needed. ## Example: Fraud detection model {#gov-airc-risk-score-calculation__example_control} A fraud detection model has three active controls. The access control review is compliant and carries the most weight, 100, because restricting who can modify the model is the most important safeguard. The data retention policy and the bias testing control are both non-compliant, each weighted at 10. The control effectiveness is `(100 ÷ 120) × 100 = 83`, close to a perfect score, but because two controls are still non-compliant, it lands in the Needs improvement band (level 1) rather than Effective. ## Primary RAM {#gov-airc-risk-score-calculation__section_primary_ram} The rollup runs against one RAM for each AI system, called the primary RAM. A RAM can be the primary RAM only when it is published, assesses risks, and belongs to the AI risk and compliance domain. Each AI system stores its own primary RAM. If you remove the primary RAM from an AI system, the AI system no longer shows rollup scores. When you don't set a primary RAM, the system selects a default. You can set the default in the sn_grc_ai_gov.aisystem_primary_ram property. ## Aggregation to the AI system {#gov-airc-risk-score-calculation__section_aggregation} The rollup includes the active related entities of the AI system that use the same primary RAM, the risks of those entities, and their assessments in the Monitor state. The rollup excludes third-line audit entries, and it skips AI systems in the Retired or Canceled state. The rollup averages the scores of the contributing risks and converts the average to a rating band. The rollup takes the maximum of the annual loss expectancy values. ## Example: Loan approval assistant {#gov-airc-risk-score-calculation__example_aggregation} A loan approval assistant has three contributing risks: unauthorized access to applicant data (inherent rating High, 7), model drift from outdated training data (inherent rating Medium, 4), and dependency on a single data vendor (inherent rating Low, 1). The average is `(7 + 4 + 1) ÷ 3 = 4`, so the inherent rating of the AI system is Medium. The control effectiveness ratings of the AI system are aggregated the same way from the values of the same risks. ## When scores are recalculated {#gov-airc-risk-score-calculation__section_recalculation} Each AI system has one risk rollup result. The system flags the result for recalculation after the primary RAM of the AI system is set or changed, or after a score-affecting change on a related entity that uses the primary RAM. A scheduled job then recalculates the scores. Scores on the AI system don't change at the moment that an assessment changes. They update after the next scheduled recalculation. ## Where the scores appear {#gov-airc-risk-score-calculation__section_where_shown} The ratings appear on the AI system record and in the Risk posture charts and risk heat map. The Risk posture page shows the All assets by aggregated risk score chart and the Risk heat map, and you can switch the charts between inherent and residual risk. For how to read them, see [Reviewing AI risk posture](https://www.servicenow.com/docs/iC4jRzwKfQF1Ft9qg6m4rA "Aggregated risk posture displays inherent risk, residual risk, and control effectiveness for AI assets."). To see which assessments contributed to the score of an AI system, use the contributing assessments of the risk rollup result. ## Review of calculated ratings {#gov-airc-risk-score-calculation__section_review_calculated} The system calculates the control effectiveness, and aggregated ratings automatically, without an assessor. The ratings can be inaccurate or incomplete, for example, when controls or assessments are out of date. Review the ratings and the assessments that produced them before you rely on them. ## Assessed classification {#gov-airc-risk-score-calculation__section_assessed_classification} An assessed classification is the inherent rating that an assessor produces for an AI asset. The assessor answers Impact and Likelihood questions, and the classification is the average of the two scores. The assessed classification is separate from the automated classification, which the system calculates from the Use and purpose responses. The system applies one of two RAMs, depending on the type of AI asset. Risk classification for AI system applies to AI systems. Risk classification for AI Model or Dataset applies to AI models and datasets. You select the RAM when the assessment starts. For the formulas, subfactor weights, and rating bands, see AI risk score calculation reference. ## Things to note for addressing errors {#gov-airc-risk-score-calculation__section_troubleshooting} If the Risk and Compliance dashboards on the AI asset record page or the landing page show a No data found error for the risk score, see [Risk score and compliance score dashboard errors](https://www.servicenow.com/docs/5VzKMpK4eYLHDIEkSZeWxg "Properties and scheduled jobs that resolve No data found errors in the risk score and compliance score dashboards on the AI asset record and landing pages.").