--- sourceDocument: Brazil Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Risk assessments # Risk assessments in Privacy Management {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Risk assessments in Privacy Management ServiceNow Privacy Management enables you to perform risk assessments on data processing activities to evaluate their risk scores and understand your organization's privacy risk posture. These assessments help prioritize processing activities based on their criticality and privacy risks, enhancing your overall data privacy governance. Show full answer Show less ## Key Features * **Criticality Assessments:** Determine the initial risk level of a processing activity to prioritize or deprioritize it. Criticality factors include whether personal data processing influences key decisions or autonomous decision-making. * **Manual Criticality Assessment:** Privacy managers can manually initiate a criticality assessment directly from a processing activity. The system calculates the criticality score using existing data and regulatory details entered on the processing activity form. This can be recalculated multiple times as data is updated. * **Automated Criticality Assessment:** Utilizes a default Automated Criticality Factors Risk Assessment Methodology (RAM). Privacy managers must publish this RAM to activate it. When users complete screening assessments with relevant criticality questions, the system auto-calculates and displays the criticality score on the processing activity overview. * **Privacy Risk Assessments:** Conducted in detail when a processing activity has a high criticality score. These assessments evaluate each associated privacy risk and provide an aggregated risk score, which is visualized on a risk heatmap showing inherent and residual risks. * **Risk Heatmaps:** Display risk assessment results on the processing activity home page, allowing you to visualize and track your privacy risk posture effectively. * **Risk Assessment Methodology (RAM):** Offers a systematic and repeatable approach for identifying, evaluating, and mitigating privacy risks related to processing activities. Two default RAMs are provided for configuring criticality and privacy risk assessments. ## Practical Use for ServiceNow Customers By leveraging these risk assessment capabilities, you can: * Identify high-risk processing activities quickly and prioritize remediation efforts accordingly. * Use automated and manual methods to flexibly assess criticality based on your organizational needs and data accuracy. * Gain detailed insights into privacy risks through comprehensive assessments and heatmaps, supporting compliance and risk mitigation strategies. * Configure and manage Risk Assessment Methodologies to tailor risk evaluations to your privacy policies. These features enable ServiceNow customers to maintain a robust privacy risk posture, streamline privacy governance, and support regulatory compliance by systematically managing risks associated with personal data processing. You can perform risk assessments on your processing activities to determine their risk scores and find out the privacy risk posture of your organization. To understand the risk posture, the following assessments are performed. ## Criticality assessments {#risk-assessments-in-privacy-management__section_dfz_j3c_d2c} A criticality assessment uses risk assessment to determine the initial risk level of a processing activity. Using the resulting criticality score, the privacy team can prioritize or deprioritize the activity accordingly. An example of a criticality factor could be that the assessment questions help identify whether personal data is being processed in a way that influences key decisions or enables impactful autonomous decision making. Criticality assessments can be performed using one of the following two methods. Manual criticality assessment : Using the manual method, as a privacy manager initiates the criticality assessment from a processing activity. If you're already working on a processing activity and want to assess its criticality, you can manually trigger this assessment using the Assess criticality action in the user interface. When you trigger the criticality assessment, the system automatically calculates the criticality score based on the information already available in the fields of the processing activity form. On the Regulatory details tab of a processing activity, you can provide the risk-related details. After entering this information, triggering the criticality assessment uses these values to calculate the risk score. The system can calculate the criticality score multiple times if triggered manually. Each time, it uses the most recent data entered in the processing activity fields and regulatory details. Automated criticality assessment : Using the automated method, the privacy manager uses the Automated criticality factors risk assessment methodology (RAM) that is provided by default to calculate the criticality score of a processing activity. The privacy managers must publish this RAM before it can be used. By default, the RAM is provided in the Draft state. When a user performs a screening assessment, they are prompted to respond to several questions, including those related to criticality and risk assessment. If the user provides answers to these criticality-related questions during the screening assessment, the system automatically calculates the criticality risk score. The calculated score is then displayed on the Overview page when the user proceeds to the processing activity. Because only two RAMs are supported at a time, they must deactivate any other existing criticality factors RAM. It is crucial to note that when an existing criticality factors RAM is deactivated, all the in-progress risk assessments associated with that RAM get canceled. ## Privacy risk assessments {#risk-assessments-in-privacy-management__section_imd_p3c_d2c} Privacy risk assessments are detailed assessments that are conducted if the criticality score is high. Assess each risk that is associated with the processing activity and know the aggregated risk score on the processing activity. After you assess the privacy risks, you can view the privacy risk posture on the risk heatmap in the overview section. The heatmaps provide detailed information about your inherent and residual risks. See the following image to understand how you can initiate the detailed risk assessment. ## Risk heatmap scores {#risk-assessments-in-privacy-management__section_nyq_s3c_d2c} The risk assessments results and the risk heatmaps appear on the processing activity home page as shown in the following image. Figure 1. Risk scores on a processing activity To understand the details about how to perform the risk assessments, see [Privacy assessment configurations](https://www.servicenow.com/docs/7zirleCp9hfckv7QvzldOw "To perform a processing activity criticality and privacy risk assessment, two risk assessment methodologies (RAMs) are provided by default."). * **[Risk Assessment Methodology (RAM)](https://www.servicenow.com/docs/vn3dJRoy4eiFdGweW0fh3Q)** Risk Assessment Methodology (RAM) provides a systematic and repeatable approach to identifying, evaluating, and mitigating privacy risks associated with data processing activities. * **[Privacy assessment configurations](https://www.servicenow.com/docs/7zirleCp9hfckv7QvzldOw)** To perform a processing activity criticality and privacy risk assessment, two risk assessment methodologies (RAMs) are provided by default.