---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Request risk modification for findings

# Request risk modification for findings {#ariaid-title1}

Release version: Australia  
Updated June 4, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create a risk modification request for multiple vulnerable items at once by using the Bulk Edit dialog to specify a desired risk rating and optional compensating controls.

## Before you begin

Risk change must be enabled on the vulnerability before you can request it for the associated items.

Role required: sn_vul.vulnerability_admin, sn_vul.vulnerability_analyst or sn_vul.remediation_owner

## Procedure

1. Navigate to WorkspacesSecurity Exposure Management Workspace.  
   Note:  
   The selected records must be in the Open, Under Investigation, or Awaiting Implementation state.
2. On the List page, under Host Vulnerable items, open the Active or All list.
3. In the list, select the check box for each vulnerable item to include in the risk modification request.
4. Select Bulk edit.
5. In the Risk rating field, select the target risk rating.
6. **Optional:** If compensating controls apply, in the Compensating controls field, select the controls that mitigate the vulnerability.
7. Select the Modify risk until date.
8. In the Work notes field, enter a summary of the risk modification justification.
9. Select Submit request.  
   A Remediation Task is created for the selected items and enters an In review state. Approval requests are raised for the risk modification.
{#reduce-risk-bulk-edit__steps_ykc_n5g_njc}

## Result

If you're a Vulnerability admin or an analyst, the state change approval (CA#) is approved immediately, the risk rating updates on the selected findings right away and rolls up to the new Remediation Task.

If you're a Remediation Owner, the state change approval (CA#) follows the configured approval process. After it's approved, the risk rating updates on the selected vulnerable items and rolls up to the new Remediation Task.  
Note:  
The sn_sec_exception.modify_risk_approval_required system property controls whether a Remediation Owner request requires approval. This property is set to true by default. If set to false, the change approval moves directly to Approved and the risk rating updates immediately for Remediation Owners too.

*[\>]: and then