Risk score rollup in Advanced Risk Assessment
Summarize
Summary of Risk score rollup in Advanced Risk Assessment
In Advanced Risk Assessment, risk scores are aggregated across risk statement hierarchies, entity hierarchies, or both, enabling stakeholders such as risk managers and entity owners to effectively monitor their overall risk posture. This rollup functionality provides a consolidated view of inherent risk scores, residual risk scores, Annual Loss Expectancy (ALE), and control effectiveness scores based on selected risk assessment methodologies.
Show less
Only risk assessments in the Monitor state contribute to the rollup scores. Different risk assessment methodologies may use distinct formulas for calculating qualitative and quantitative rollup scores, which are configured within each methodology’s Rollup configurations.
Key Features
- Risk Statement Hierarchy Rollup: Automatically aggregates scores such as inherent risk, ALE, control effectiveness, and residual risk across the risk statement hierarchy, helping risk managers assess enterprise-wide risk posture.
- Entity Hierarchy Rollup: Aggregates risk scores and ALE values across entity hierarchies for each risk assessment methodology, enabling entity owners to monitor their entity’s risk posture using formulas like Sum, Average, Maximum, or Minimum.
- Combined Reporting Dimensions: Using the Manage Aggregated Risk report, customers can define additional dimensions for monitoring risks, such as internal fraud risks within specific business units.
- Automatic Rollup Activation: Rollup scores are calculated automatically upon activation of the Advanced Risk plugin.
Migration and Reporting Changes
When migrating to Advanced Risk Assessment, risk administrators with the snrisk.admin role must enable the Migrate to Advanced Risk Assessments property via the administration properties. This property is disabled by default and enabling it changes how rollup scores are calculated and displayed.
Important considerations during migration:
- Customizations on the risk overview dashboard will be hidden; customers should contact ServiceNow for support.
- Certain legacy reports and dashboard tabs (e.g., Aggregated Risk Report, Exposure by Entity, Entity Tolerance Status) become hidden.
- New modules under Aggregated Risk Report become visible, showing rolled-up scores by risk statements, entities, and combined views.
- Individual risk score values no longer roll up directly; instead, aggregated values from advanced risk assessments are used.
- Risk Rollup and Tolerance sections are replaced with an Aggregated Risk related list on entity and risk statement forms, displaying key metrics such as residual rating, inherent rating, control effectiveness, ALE values, contributing risk assessments, and rollup status.
Practical Benefits for ServiceNow Customers
This rollup feature enables ServiceNow customers to gain a unified, accurate, and hierarchical view of risk across their organization. It simplifies monitoring and reporting of risk posture at multiple levels, supports customized risk dimension reporting, and aligns risk data with advanced methodologies. Migration to this approach requires administrative setup but results in enhanced visibility and consolidated risk management capabilities.
In Advanced Risk Assessment, risk scores are calculated across risk statement hierarchy, entity hierarchy, or a combination of both. These methods enable stakeholders to monitor their risk posture and provide visibility of the overall aggregated risk score.
- Each entity might have multiple scores based on the different risk assessment methodologies.
- Only the risk assessments in the Monitor state contribute to the risk score.
- Each risk assessment methodology might have a different formula to calculate the rollup qualitative score and the rollup quantitative score. The formula is specified in the Rollup configurationssection in the risk assessment methodology form.
- Whenever the Advanced Risk plugin is activated the risk scores get rolled up.
Risk statement hierarchy
Based on the assessments, the system automatically rolls up the inherent risk scores, the Annual Loss Expectancy (ALE), control effectiveness score, residual risk score, and ALE across the risk statement hierarchy for the selected methodology. This rollup allows the risk managers to monitor their enterprise risk posture.
Entity hierarchy
- Sum
- Average
- Maximum
- Minimum
Entity hierarchy and risk statement
Using the Manage Aggregated Risk report, customers can define additional reporting dimensions on which they want to monitor the risk posture for an entity. For example, if you want to understand an internal fraud related risk for Retail Banking, you can define that reporting dimension and monitor the risk.
Changes in reports and risk rollup method after migrating to Advanced Risk Assessment
- Compare risk tolerance based on
- Compare calculated risk score with
- Aggregated Risk Report
- Exposure by Entity
- Exposure by Risk Statement
- Entity Tolerance Status
- Risk Tolerance Status
- Aggregated Entity Information
- Aggregated Risk Information
- Aggregation by Risk Statements
- Aggregation by Entities
- Entity by Risk Statements
- Risk assessment methodology
- Residual rating
- Inherent rating
- Control effectiveness
- Residual ALE
- Inherent ALE
- Contributing risk assessments
- Risk rollup status