--- sourceDocument: Brazil Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Risk assessment methodologies # Risk assessment methodologies {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read The AI Risk and Compliance application uses risk assessment methodologies (RAMs) to define the scoring frameworks and classification criteria used during risk assessments. ## Risk assessment methodologies overview {#airc-rams__rams-overview} RAMs define the scoring frameworks and classification criteria used during risk assessments. ## Risk assessment methodologies {#airc-rams__risk-assessment-methodologies} Risk assessment methodologies (RAMs) define the scoring frameworks, classification criteria, and contributing factors used to evaluate risks associated with AI assets. RAMs are used during intake, asset-level risk assessments, and bulk risk assessment projects. The content pack provides default RAMs, and administrators can create custom RAMs to meet organizational requirements. {#airc-rams__risk-assessment-methodologies__entry__4} | RAM | Applies to | Purpose | When used | |-|-|-|-| | Risk classification for AI system | AI systems | Classifies AI systems by regulatory risk level based on factors captured during intake or assessment. | During intake screening or early assessment to determine initial regulatory risk classification. | | Automated risk classification for AI system | AI systems | Automatically assigns an initial regulatory risk classification based on Use and Purpose responses. | During intake when automated screening is enabled. When configured and applied to the AI use case request form, this RAM evaluates responses in the Use and Purpose section and assigns a risk classification such as High, Medium, Low, or Unacceptable. | | Risk assessment for AI inventory | AI systems, models, datasets | Evaluates individual risks using likelihood, impact, and control effectiveness to calculate inherent and residual risk scores. | During asset-level and bulk risk assessment projects. Individual risk scores roll up to form an aggregated risk score visible on the AI asset record and the Risk and Compliance dashboard. This RAM is the default for bulk risk assessment projects. You can also specify it as the default primary RAM for all risk assessments using the `sn_grc_ai_gov.aisystem_primary_ram` property. | | Risk classification for AI model or dataset | AI models, datasets | Classifies models and datasets by risk level based on characteristics, data sensitivity, and intended use. | When models or datasets require independent governance evaluation. Unlike AI system classification RAMs, this RAM isn't applied through a global property. It's selected when initiating a risk assessment on an AI model or dataset and evaluates characteristics such as data sensitivity, intended use, and associated risk factors. | [Table 1. Default risk assessment methodologies] For information about coordinating multiple risk assessments together, see [Risk assessment project in AI Risk and Compliance](https://www.servicenow.com/docs/YXvERKbrezJSbBAVqhnK1Q "You can perform assessments on multiple risks and controls simultaneously by creating a risk assessment project for an AI asset. This feature enables assessors to review multiple risks to understand their potential impact, likelihood, and associated mitigation strategies."). Important: Automated and advanced risk scoring behavior depends on RAM configuration. To enable risk score roll-up across AI assets, install the Advanced Risk application and migrate to Advanced Risk Assessments. This is a one-way configuration change. ## Risk assessment methodology configuration {#airc-rams__rams-business-configuration} Administrators can configure which risk assessment methodologies (RAMs) are applied during intake, assessment, and risk evaluation workflows. Configuration options include specifying default RAMs for AI systems, models, and datasets, and enabling automated or advanced risk calculation behavior. To configure automated risk classification during intake, specify the `sn_grc_ai_gov.ai_system_automated_risk_classification_asmt_ram` property. To define the default RAM used for risk assessments across AI systems, set the `sn_grc_ai_gov.aisystem_primary_ram` property. For more information, see [Set up AI Risk and Compliance properties](https://www.servicenow.com/docs/RvkicQO4QvWJtxjjbt6hjw "Configure AI Risk and Compliance properties to specify which authority documents and policies you want to display on the home page. You can also specify a default automated risk classification assessment RAM for AI systems and specify a default RAM to be used for risk assessments of AI systems."). Important: To enable risk score roll-up across AI assets, install the Advanced Risk application and set the Migrate to Advanced Risk Assessments property to Yes. This is a one-way configuration change that permanently transitions risk calculation and roll-up behavior to the Advanced Risk framework. See [Set up Advanced Risk assessments properties](https://www.servicenow.com/docs/RT44rw5iOIlN5i0DBlHhXw "Enable Advanced Risk Assessments (ARA) to confirm that risk‑based assessments and risk score roll‑up function correctly in the AI Risk and Compliance application."). ## Automated risk classification workflow {#airc-rams__how-they-work-together} Automated Risk Classification connects intake screening, assessments, and risk evaluation into a single governance flow. Information captured during the intake request, specifically responses provided by the Product Owner in the Use and Purpose section, is reused across subsequent assessments and contributes directly to how AI systems are classified as High, Medium, or Low risk. Assessment templates, RAMs, and Post Assessment Actions work together to help ensure that qualitative context, regulatory impact, and quantitative risk scoring are consistently applied throughout the AI governance life cycle. A typical assessment sequence for an AI system demonstrates how these components are interconnected: 1. During intake, the Automated risk classification for AI system RAM evaluates responses captured in the Use and Purpose section of the AI use case request and assigns an initial regulatory risk classification. 2. During the Assess phase, the risk assessment captures information about the system's potential impact on privacy, fairness, and other fundamental rights. Responses from the Use and Purpose section are carried forward to provide continuity and reduce duplicate data entry. 3. Post Assessment Actions evaluate the risk assessment responses and automatically associate applicable risk statements and control objectives with the assessment record based on configured automation rules. 4. An AI Risk and Compliance analyst reviews the prescribed list of generated risks and control objectives to validate accuracy, relevance, and applicability before governance records are finalized. 5. After the assessment is marked as closed complete, the system generates risk and control records and maps them to the AI asset. The Risk assessment for AI inventory RAM then evaluates each identified risk using quantitative scoring to calculate inherent and residual risk scores. 6. For AI systems subject to the EU AI Act, additional assessments such as the EU AI Act Conformity Assessment and the Fundamental Rights Impact Assessment (FRIA) provide specialized regulatory evaluation. {#airc-rams__ol_b3m_tzk_gjc} Throughout this progression, assessment outcomes and risk scores inform governance decisions about whether an AI system can advance to the next life-cycle phase. For an overview of how these activities align with life-cycle stages, see [AI governance life cycle](https://www.servicenow.com/docs/mwLJXm_YPAzzc1fcRFyrjA "Learn more about how organizations can govern AI from initial demand through deployment and ongoing governance monitoring by using the AI Control Tower and AI Risk and Compliance applications together."). Note: Automated risk classification provides early risk context only. It doesn't approve deployment, initiate life-cycle workflows, or replace downstream impact or risk assessments.