---
sourceDocument: Zurich Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Workflow of project risk assessment

# Workflow of project risk assessment {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Workflow of Project Risk Assessment

This workflow explains how ServiceNow integrates Project Portfolio Management (PPM) with Governance, Risk, and Compliance (GRC) for effective project risk assessment.
It guides project managers and risk specialists through identifying, assessing, and managing risks within projects and escalating them to enterprise risks when necessary.
Show full answer Show less  

## Key Features

* **Risk Identification:** Project managers with the roles `itprojectmanager` and `sngrc.businessuser` identify and add risks to projects, either by creating new risks or selecting from a risk library.
* **Risk Assessment Initiation:** Assessors and approvers configured in the Project Integration Configuration form receive email notifications to assess risks. Only risks in Pending, Open, or Work in Progress states can be assessed.
* **Risk Assignment:** If stakeholders are designated as assessors, project managers must manually assign risks to the relevant stakeholders.
* **Risk Assessment Execution:** Risk assessors perform assessments via email links or by navigating to Advanced Risk Assessment tasks within the platform.
* **Review and Elevation:** Project managers review assessment scores in the Risk Assessment Summary and can elevate significant project risks to enterprise risks, which are copied to the enterprise risk register for further evaluation.
* **Enterprise Risk Management:** Elevated risks require assessment by enterprise risk managers who also hold the `sngrc.businessuser` role. Any reassessment triggers notification emails to ensure ongoing risk monitoring.
* **Risk Materialization and Issue Conversion:** Should a risk materialize, project managers can convert the risk into an issue as part of the RIDAC (Risk, Issue, Decision, Action, and Change Requests) framework.
* **Risk Visualization and Reporting:** The project risk posture is visualized using a heatmap highlighting high impact and high likelihood risks, enabling prioritization. An aggregated risk score provides a consolidated metric for stakeholder reporting.
* **Dashboards:** The Project Risk Overview dashboard offers insights into overall project and enterprise risk postures, facilitating informed decision-making.

## Key Outcomes

* Streamlined risk identification and assessment within projects ensuring timely risk awareness and management.
* Clear escalation path from project risks to enterprise risks, helping protect the organization from significant monetary or reputational losses.
* Defined roles and notifications ensure accountability and prompt action from project managers, risk assessors, and enterprise risk managers.
* Visualization tools such as heatmaps and dashboards support risk prioritization and effective communication to stakeholders.
* Integration with RIDAC supports risk mitigation by converting risks into actionable issues when necessary.  
To understand the integration of Project Portfolio Management and Governance, Risk, and Compliance risk management capabilities, it is important to understand the
workflow of project risk assessment.

Project risk assessment follows a sequence of steps. Sometimes, a risk is elevated to an
enterprise risk after the risk is assessed. An enterprise risk is a risk that can cause
monetary or reputational losses. It can jeopardize your ability to stay in business.  
The workflow of project risk assessment is as follows:

1. A project manager identifies risks and adds those risks to a project. The manager can either create risks or add them from a library. The project manager has the it_project_manager and sn_grc.business_user roles. For more information, see [Add risks for a
   project](https://www.servicenow.com/docs/access?context=add-risks-for-project&version=zurich&pubname=zurich-it-business-management&ft:locale=en-US).
2. The project manager then initiates risk assessment for the newly added risks. In the Project Integration Configuration form, the assessors and approvers are defined for the assessment. They get an email notification to assess the risks.  
   Note:  
   You can only assess the risks that are in the Pending, Open, or Work in Progress state.
3. If the Project Integration Configuration form has stakeholders selected as assessors, then the project manager must manually assign the risks to the relevant stakeholder.
4. As a risk specialist, the risk assessor is notified about the new risks for assessment.The risk assessor can use the link in the email notification to start the assessment. Alternatively, the risk assessor can navigate to Advanced Risk AssessmentRisk Assessment TasksMy Tasks to perform advanced risk assessment. See [Advanced Risk Assessment](https://www.servicenow.com/docs/c_f9z3iB8RH3gO2KkUANhw "Use the ServiceNow Governance, Risk, and Compliance (GRC) Advanced Risk Assessment feature to create an integrated risk platform. This integrated platform supports various kinds of risk assessment methodologies. It enables you to integrate risk assessment as part of your overall decision-making process.").

5. In the project risk form, the project manager reviews the Risk Assessment Summary section to view the risk assessment scores.
6. If the project manager determines that the project risk has an impact on the enterprise, then the project manager can elevate the risk to an enterprise risk.  
   Note:  
   When a project risk is elevated to an enterprise risk, the project risk is copied from the project risk register to the enterprise risk register.
7. If a risk is elevated to an enterprise risk, the enterprise risk manager is requested to assess the risk.
8. The project manager views the enterprise inherent risk score and the enterprise residual risk score in the Risk Assessment Summary.
9. As part of the Project Portfolio Management workflow, if a risk materializes and an action must be taken for this risk, then the project manager can convert the risk into an issue. For more information, see [RIDAC (Risk, Issue,
   Decision, Action, and Request Changes) record entries for a
   project](https://www.servicenow.com/docs/access?context=ridac-entries-for-project&version=zurich&pubname=zurich-it-business-management&ft:locale=en-US).
10. The project manager can also view the project risk posture through the heatmap in the Risk Overview section on the project form. The heatmap displays high impact risks and high likelihood risks. With the heatmap, you can prioritize the risks that need immediate attention. The risks that are assessed contribute to the aggregated risk score. The aggregated risk score is a single score that can be reported to all the stakeholders. For more information, see [Create a
    project](https://www.servicenow.com/docs/access?context=t_CreateAProject&version=zurich&pubname=zurich-it-business-management&ft:locale=en-US).
11. View the Project Risk Overview dashboard to understand the overall risk posture of project risks and of enterprise risks. For more information, see [Project Risk Overview dashboard](https://www.servicenow.com/docs/dYhu5vjMNjdFzRgKgGa09w "The project risk dashboard is useful for project managers and the enterprise risk managers. Using this dashboard, the project managers and enterprise risk managers can view the risk performance and the overall risk posture. This dashboard helps risk managers to reduce the overall risks in an organization.").
{#workflow-of-ppm-risk__ol_zmr_qk3_4mb}  
Note:  
The assessor and the approver must have risk business user role (sn_grc.business_user) to perform the required tasks. If the project risks are reassessed for any reason and the scores change, then the enterprise risk assessor gets an email notification with the option to reassess the enterprise risk.  
The key users and the user journey are shown in the following figures.Figure 1. Key users of Project Portfolio Management and Risk Integration Figure 2. User journey of Project Portfolio Management and risk integration

*[\>]: and then