Create an automated factor

  • Release version: Australia
  • Updated March 12, 2026
  • 4 minutes to read

    • Create automated factors to automatically fetch data from other data sources such as tables or database views.

    Before you begin

    You must have the Governance, Risk, and Compliance Enterprise license.

    Role required: sn_risk.admin

    About this task

    Automated factors help automate the risk assessment process. They do not to rely on manual inputs, and they thus reduce subjectivity. All the responses to automated factors are automatically calculated during the assessment.

    Procedure

    1. Navigate to All > Advanced Risk Assessment > Administration > Automated Factors.
    2. Click New.
    3. On the form, fill in the fields.
      Table 1. Automated Query Factor form
      Field Description
      Name Name of the factor such as Regulatory Impact.
      Factor contribution Type of factor contribution. Choices are the following:
      • Qualitative: Provides a numerical score and then converts the score into a rating.
      • Quantitative: Provides the losses that can be incurred in monetary terms. The losses contribute to the annual loss expectancy (ALE).
      • Both: Assessment type is both qualitative and quantitative.
      Display order Order of questions in the assessment form. This field enables you to set a specific sequence in which the questions must appear.
      Response type Options for users to respond to the factors. Choices are the following:
      • Number: The factor response after automatic calculation will be a number.
      • Currency: The factor response after automatic calculation will be in currency.
      • Percentage: The factor response after automatic calculation will be a percentage.
      Assessment context Context where the assessment must be performed. Choices are the following:
      • Risk: Select this option to perform the assessment for an entity and for an associated risk.
      • Object: Select this option to perform an assessment on any ServiceNow record. For example, users can perform Exception Risk Assessment or Change Risk Assessment directly on an object.
      State State of the factor. This field is automatically set to Draft.
      Qualitative weighting (%) Score contribution or qualitative weight that is given to the factor. This value determines the actual contribution of this factor to the final score. This field appears only when Qualitative is selected from the Factor contribution field.
      Transform qualitative score Option to transform the overall group qualitative score based on an interval scale.

      For example, assume the User response field is set to Percentage. As the admin, you can transform the percentage value into a qualitative score, such that 0% to 30% is low, 30% to 60% is medium, and 60% and higher is high. In this case, the ratings 1, 2, and 3 can be assigned to low, medium, and high.

      This field appears only when Qualitative is selected from theFactor contribution field.
      Collect supporting data Option for collecting supporting data. If this option is selected, the Supporting Data section appears.
      Description Brief description about the purpose of the factor and where to use the factor. This description is for the administrator to understand the factor.
      Data Source
      Source Table or view that is used as the source of the factor.
      Filter Criteria
      Filter by entity Option for filtering the source by the risk assessment instance entity.
      Entity-mapping field Field that refers to the Entity table. This field appears only when the Filter by entity option is selected.
      Filter by risk Option for filtering the source by the risk of the risk assessment instance.
      Risk mapping field Field that refers to the Risk table. This field appears only when the Filter by risk option is selected.
      Filter by control Option for filtering the source by the risk assessment instance control. This option applies only to the individual assessment of controls in the control assessment.
      Control mapping field Field that refers to the Control table. This field appears only when the Filter by control option is selected.
      Filter by object Option for filtering the source by the object of the risk assessment instance. This field appears only when you are performing the risk assessment on an object.
      Object mapping field Field that refers to an object in the assessment instance. This field appears only when Object is selected from the Assessment context field, and when the Filter by object option is selected.
      Aggregation.
      Aggregation type Formula for aggregating the records that are selected from the table in the Source field. Choices are the following:
      • Sum: Sum of the aggregation column.
      • Average: Average value of the aggregation column.
      • Maximum: Maximum value of the aggregation column.
      • Minimum: Minimum value the aggregation column.
      • Count: Count of number of records of the aggregation column.
      • Count distinct: Number of unique records of the aggregation column.
      Aggregation column Column that is used for aggregation based on the table selected in the Source field.
      Schedule
      Frequency Frequency of when the factor is run.
      Day of the week Day of the week when the factor is run. This field appears only when Weekly is selected from the Frequency field.
      Day of month Day of the month when the factor is run. This field appears only when Monthly is selected from the Frequency field.
      Month Month when the factor is run. This field appears only when the Frequency field has the values Quarterly, Semi-annually, or Annually.
      Next run date Date when the factor runs again. This field is automatically set based on the selections made on the form.
    4. Click the Supporting Data section.
    5. For the data that you want to collect, move the corresponding fields from the Available list to the Selected list.
    6. Click Submit.
    7. Open the factor that you created.
    8. Click Publish.

    Result

    The factor is published and is ready for use in a Risk Assessment Methodology.