---
sourceDocument: Zurich Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Engagement risk scoring rules

# Define engagement risk scoring rules {#ariaid-title1}

* Release version: Zurich
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

An engagement risk-scoring rule specifies component criteria that determine which engagements are selected for assessment. For example, a rule could enable assessments for engagements that involve more than $40,000 annual business. Engagement scoring rules apply only to engagements.

## Before you begin

Role required: sn_vdr_risk_asmt.vendor_risk_manager

## About this task

Important:  
Engagement risk scoring rules apply only to engagements and not to parent third parties. Engagement risk rating scores, therefore, apply only to risk assessments for the engagement.

## Procedure

1. Navigate to AllThird-party Risk ManagementScoring SetupEngagement Risk Scoring Rules.  
2. Select New, fill in the form, and then select Submit.  
   {#tprm-engagement-scoring-rules-df__table_eng-scoring-rule__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the scoring rule. |
   | Description | Description of the scoring rule. |
   | Number | For each engagement risk scoring rule, the system auto-assigns a unique ID number that starts with the text ERS. The unique ID is used in all references to the item. You can use the ID to search or filter for the item that you want to work on. |
   | Third-party risk area criteria | The third-party risk area criteria that applies to this engagement risk scoring rule. A third-party risk area criteria is a group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party. See [Define third-party risk area criteria](https://www.servicenow.com/docs/RXPB2FHtv7ubOKYGCi~2OQ "A third-party risk area criteria is a group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party.") for details on how criteria are defined. |
   | Engagement risk component criteria | The engagement risk component criteria that applies to this engagement risk scoring rule. Components are the entities for which you can assess risk (for example, subsidiaries or engagements). A component criteria is a group of components that should apply to a particular type of third party or engagement. |
   | Active | Option to activate the rule. Only active rules are applied to engagements. |
   | Order | Specify the order to indicate the rule's precedence. If multiple rules apply to the same engagement, the one with the higher-order value is applied. |
   | Engagement Filter | Criteria for selecting engagements. Use the [condition builder](https://www.servicenow.com/docs/access?context=c_ConditionBuilder&version=zurich&pubname=zurich-platform-user-interface&ft:locale=en-US) to define the criteria. For example, you can perform assessments for third parties with whom you do considerable business: <kbd class="ph userinput">Annual spend is greater than $40,000</kbd> or third parties within a particular category: <kbd class="ph userinput">Category is software</kbd>. |
   [Table 1. Engagement Risk Scoring Rules form]

   {#tprm-engagement-scoring-rules-df__table_eng-scoring-rule}

*[\>]: and then