--- sourceDocument: Brazil Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Workflow of a risk using Advanced Risk # Workflow of a risk using Advanced Risk {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Workflow of a risk using Advanced Risk With the Advanced Risk Assessment feature enabled in ServiceNow (available from Brazil release and enhanced in version 14.0), risk management transitions from the classic binary states (active or inactive) to a more detailed lifecycle. This lifecycle includes multiple states---Draft, Assess, Respond, Monitor, and Retire---that provide clearer visibility and simplified actions for risk owners and administrators. Show full answer Show less Enabling the **Migrate to Advanced Risk Assessments** property under Advanced Risk Assessment administration transforms how risks are handled, streamlining workflows and allowing initiation of risk assessments directly from the risk form. Note that once enabled, this property cannot be disabled. ## Risk Lifecycle States and Actions * **Draft:** Initial state when a risk is identified or created. The focus is on mapping and identifying risks. Actions include saving, starting an assessment, monitoring without assessment, retiring the risk, navigating to the assessment scope, or viewing 360-degree relationships. * **Assess:** Active risk assessment in progress. Upon completion, risks with response strategies proceed to the Respond state, otherwise to Monitor. Actions include saving, viewing or canceling the assessment (notifying assessors), returning to draft, retiring, navigating assessment scope, and viewing 360-degree relationships. * **Respond:** Risk response tasks are underway. After closing the response task, the risk moves automatically to Monitor. Actions include saving, reassessing, retiring, navigating assessment scope, viewing 360-degree relationships, or returning to draft. * **Monitor:** Post-assessment state where Key Risk Indicators (KRIs) execute to track the risk. Actions include saving, reassessing, retiring, navigating assessment scope, viewing 360-degree relationships, or returning to draft. * **Retire:** The risk is no longer active but retained for audit purposes. Actions include viewing 360-degree relationships and reactivating the risk back to Draft state. ## Practical Benefits for ServiceNow Customers * **Enhanced Risk Visibility:** The multi-state lifecycle offers more granular control and transparency over risk progression. * **Simplified Risk Management:** The streamlined risk form and workflow actions reduce administrative overhead and improve efficiency. * **Integrated Monitoring:** Execution of KRIs in the Monitor state helps maintain ongoing risk oversight. * **Audit Compliance:** Retired risks remain in the system for record-keeping and audit purposes. ## Next Steps To leverage this advanced risk workflow, ensure the **Migrate to Advanced Risk Assessments** property is enabled by your risk administrator. Familiarize your risk owners with the lifecycle states and available actions to optimize risk assessment, response, and monitoring within your organization. When you migrate to advanced risk assessment, you can view the various states of the risks take the necessary actions. This ability simplifies your view of the risk form. When your risk administrator enables the Migrate to Advanced Risk Assessments property located under Advanced Risk AssessmentAdministrationProperties, the life cycle of the classic or legacy risks undergo a change. You can also initiate a risk assessment directly from the risk form. Note: Once you enable this property, you cannot disable it. Prior to version 14.0, when the Migrate to Advanced Risk Assessments property was enabled, the risks were only classified as either active or inactive. Starting with version 14.0, as a risk owner, when you enable Advanced Risk, you can view the following states of your risks. 1. Draft 2. Assess 3. Respond 4. Monitor 5. Retired {#risk-lifecycle-using-advanced-risk__ol_c3w_w4w_zrb} Figure 1. States of a risk with advanced risk assessment All the states and the actions available for each state are explained in the following table.{#risk-lifecycle-using-advanced-risk__table_q3p_y4j_xsb__entry__3} | State | Description | Actions available | |-|-|-| | Draft | This is the state of a risk when a risk is created by the second line of defense or identified by the first line of defense. The objective in this state is to map and identify the risk pertaining to your organization. If you modify the entity or the primary risk assessment methodology (RAM) for a risk, the state of the risk gets updated based on the primary RAM's latest assessment. | * Save * Assess: Pushes the workflow and initiates the risk assessment. * Monitor: If you do not want to assess the risk but want to monitor the risk. * Retire: The risk is retired along with all underlying risk assessment and risk response. * Navigate to assessment scope: Shortcut to risk assessment scope. The primary risk assessment methodology is passed. * 360 degree: View the complete 360-degree relationships for the risk. {#risk-lifecycle-using-advanced-risk__ul_umf_2pj_xsb} | | Assess | This is the state of a risk when advanced risk assessment is initiated and being performed. If there is a response strategy, then the risk moves to the Respond state otherwise it moves to the Monitor state once the assessment is completed. | * Save * View assessment: Navigates to the actual risk assessment form. * Cancel assessment: If you want to cancel the current assessment. The respective risk assessor is notified about the canceled assessment. * Return to draft: Cancels the current assessments and returns the risk to the previous state. * Retire * Navigate to assessment scope * 360 degree {#risk-lifecycle-using-advanced-risk__ul_vzb_bwk_xsb} | | Respond | This is the state of the risk when the risk response task is in progress. Once the risk response task is closed, the risk is automatically moved into the Monitor state | * Save * Assess: Pushes the workflow back in the workflow. The in-progress risk response task would be canceled. * Retire * Navigate to assessment scope * 360 degree * Return to draft {#risk-lifecycle-using-advanced-risk__ul_g3w_3wk_xsb} | | Monitor | This is the state of the risk when the risk has been assessed and the response task is closed. If KRIs are defined (through Metrics), they are executed to monitor the risk. | * Save * Assess: Moves the risk back to Assess state and initiates the risk assessment. * Retire * Navigate to assessment scope * 360 degree * Return to draft {#risk-lifecycle-using-advanced-risk__ul_c35_nwk_xsb} | | Retire | This is the state of the risk when the risk is no longer valid but the organization wants to keep a system of record for audit purposes. | * 360 degree * Activate: Reactivates the risk and moves it back to Draft state. * Navigate to assessment scope. {#risk-lifecycle-using-advanced-risk__ul_yrp_twk_xsb} | [ ] {#risk-lifecycle-using-advanced-risk__table_q3p_y4j_xsb} **Related concepts** * [Manage risks linked to the same risk statement](https://www.servicenow.com/docs/jPUnWyafCRvEMytUTjFyIA "You can create and associate multiple risks to the same risk statement and entity combination. This association benefits the risk managers and the entity owners.") **Related reference** * [Risk hierarchy and scoring](https://www.servicenow.com/docs/EUsSeeOUa0iNQ50yr2d9Hg "Starting with New York, risk managers can create hierarchies that include different types of risk (operational risk, IT risk, or strategic risk). Once the underlying risks are assessed, the risk scores are automatically rolled up across the risk statement hierarchy, providing better tactical and strategic decision-making.") *[\>]: and then