foreign welcome to the how to now series covering features and functionality within the integrated risk management product Suite in this video we will dive into how to set up Advanced risk Assessments in servicenow's risk management application please note all features and functionality are relevant for the Utah release let's start by understanding what a risk assessment is risk assessments are a key part of effective risk management and facilitate decision making in organizations they focus on identifying risks and organization faces analyzing the severity of those risks and evaluating and prioritizing them accordingly Linda is a risk manager within demo incorporation she has been facing challenges with managing risk Assessments in her organization such as manual risk assessment processes that are time consuming risk assessment data spread over several document Management Systems lack of accountability varying risk hours being used across business units and the inability to provide holistic reporting to Senior Management Linda wants to transform the risk assessment process within her organization using the advanced risk assessment in servicenow this will provide a single source of Truth for data standardized and automated risk assessment process it will drive accountability and ownership of risks as well as risk aggregation across the organization additionally it will provide real-time monitoring of risks as well as holistic reporting across the organization in order to complete Advanced risk assessments and servicenow a risk assessment methodology or Ram needs to be set up Linda will assign origin as the risk admin to complete the ram ensuring she provides him all the information he needs on the risk assessment process the ram allows risk admins to configure their risk assessment templates by documenting what is being assessed and how it is assessed within the same instance multiple risk assessment methodologies can be configured so what are the steps required to set up the ram there are four key steps for users with the risk admin role to effectively set up a Ram one Define the assessment context 2. Define the assessment type including factors and scoring logic three Define assessment preferences and settings and finally number four Define how the risk rating should roll up through the hierarchies let's take a look at how to define assessment context two different kinds of risk assessments can be configured depending on their context the first risk-based assessments is when an individual risk must be identified and assessed in the context of an entity the second is object-based assessments which allows the risk assessment of any object within servicenow without the need to identify individual risks only the table of the object is required within demo Corporation operational risks will be assessed in the context of departments so that stakeholders can self-assess risks that affect them as well as the impact of the controls that have been put in place therefore risk-based assessments would be the appropriate type for this example as risks are being assessed in the context of an entity in this case departments let's see how Arjun can set this up in the system before beginning go to the administration module in advanced risk assessment and confirm that the migrate to Advanced risk assessments property is enabled as a risk admin Arjun searches for risk assessment methodologies in the search box and then clicks new and provides a name for the ram next he selects risk as the assessment context please note this cannot be amended after the ram is saved next departments are selected as the applicable entity class as they are the scope of the assessment Arjun then saves the record now the assessment context has been completed let's move to the next step to define the assessment types when a ram template is defined it can include a single assessment type or any combination of three available assessment types these are inherent risk control Effectiveness and residual risk for each assessment type factors and scoring calculation logic needs to be configured for residual risk either factors or the inherent risk and control Effectiveness can be used for the calculation factors are the basic building blocks for any risk assessment a factor captures a question and a response in the risk assessment which should be used to arrive at the score for the risk assessment a manual Factor includes any question where a human response is required a group Factor includes manual factors that are grouped logically together the group's Factor score depends on the responses of the corresponding manual factors an automated Factor includes any question whether response is already available and can be automated an automated scripted Factor offers the same benefits with the additional flexibility to write business logic Arjun will need the three assessment types to analyze risks for his Ram the inherent risk will use impact and likelihood factors with a product scoring Logic the control Effectiveness will use a single control Effectiveness factor with a weighted average scoring logic and finally the residual risk will be calculated using the inherent risk and control Effectiveness assessment results this approach is known as a qualitative risk assessment as the selection of likelihood impact and control Effectiveness ratings our interpretation based by the relevant assessors such as process and asset specialists in the business foreign assessment on the other hand are numbers based immeasurable for example calculating the monetary loss value if the risk occurs to calculate the inherent risk Linda is measuring the likelihood or probability of the risk occurring the likelihood rating is manually selected from a five-point scale from remote to almost certain as the likelihood ratings require a human response this will be a manual Factor let's see how Arjun sets this up in the system first he searches for manual factors in the search box he then clicks new to create a manual factor for likelihood and provides a name next the factor contribution is set to qualitative and the user responses Choice as the assessors will select a value from a list Arjun then adds a description and the likelihood rating table to provide guidance for the assessors by saving the record the choices table appears at the bottom of the screen where the drop down values and scores can be documented to add a new value Arjun clicks new and fills in the display and score values foreign once all values are populated the likelihood Factor needs to be published so it can be added to the ram to calculate the inherent risk Linda is also measuring the potential losses associated with an identified risk using impact ratings the impact factor is measured using a five-point scale from very low up to very high she has multiple manual factors including Financial operational health and safety and reputational that contribute to the overall impact rating therefore a group factor is required here each factor can have its own weighting and the total impact is calculated by taking the weighted average of all the manual factor ratings in the same way as the likelihood Factor Arjun must first set up a manual factor for each of the impacts please note that the waiting varies for each factor once these are completed a group Factor needs to be set up Origins such as group Factor and clicks on new he provides a name and ensures the factor is qualitative and the assessment context is risk the formula to calculate the impact is set to weighted average and the transform qualitative score stays selected Arjun then saves the record now each manual impact factor that will calculate the overall impact rating can be added using the edit button Arjun then defines the transformation criteria so that the correct impact rating is applied to the calculated score which could be between integers Arjun clicks new and adds the display name of the rating the lower limit of the range and the score he then repeats this for each rating and publishes the impact group factor to calculate the control Effectiveness Linda is also evaluating the effectiveness of controls to mitigate the risk Linda must specify how controls should be assessed she can either assess the overall control environment or assess each control in context of risk which requires the policy and compliance plugin Linda will assess the whole control environment for her assessment the effectiveness rating is manually selected from a five-point scale from totally ineffective all the way to fully effective as the control Effectiveness ratings require a human response this will be a manual Factor Arjun sets up the control Effectiveness in the same way as the other manual factors he fills in the standard information provides the guidance table and enters the ratings and corresponding scores once the factors are configured the scoring logic needs to be defined for each assessment type and this is used to calculate the overall assessment score pre-packaged formula can be selected or custom definitions can be generated via a script please note different formula can be used for qualitative and quantitative scoring Linda has a documented risk Matrix used to calculate inherent risk via the likelihood and impact factors Arjun is responsible for documenting the inherent risk scores and ratings in the qualitative rating criteria this is found in the inherent assessment and transforms numerical scores into risk and risk appetite ratings Linda also has a documented inherent risk and control Effectiveness Matrix which she uses to calculate the residual risk within the residual assessment form Arjun again is responsible for defining the values in The Matrix tab to visualize risk on a heat map the heat map profile is required to be configured Arjun must specify which factors are plotted on the X and Y axis as well as the color of the intersection of the responses for both inherent and residual risk now the assessment types of completed let's move on to the assessment preferences there are multiple assessment preferences that can be configured by the risk admin during the setup of the ram let's take a look at these in a bit more detail reference information available to the assessor while they are completing the risk assessment can be defined including related risk events related risk indicators open issues and the previous five risk assessments if available to help ensure the risk assessment is performed in the correct period notifications can be used to remind the assessors there are two emails available where the number of days can be set for both notifications the first is an advanced reminder which has sent the number of days defined before the assessment is due the second is an overdue reminder which is sent the number of days defined after the assessment is due and not completed please note if the value is set to zero then no emails will be sent additional functional configurations on the ram can be configured including enabling the risk response which allows a separate workflow to manage risk responses such as accept mitigate avoid and transfer this provides the ability for Risk Managers to create tasks and assign these to relevant stakeholders the second is allow override of results which allows risk assessors to override the calculated inherent control or residual risk ratings copying previous responses allows the risk assessor to Auto populate the responses with the previous assessment answers and finally risk identification this can be switched on or off if on assessors can identify new risks manually add from the library or do both foreign the business validations tab allows risk admins like Arjun to decide if mandatory or automated actions should be taken during the risk assessment including a mandatory final comment at the end of the assessment a mandatory risk response so whether the risk will be mitigated accepted transferred or avoided to automatically create an issue and to validate if the residual score is lower than the inherent score conditions can be defined for when these actions should occur a mandatory final comment and risk response can occur always on breach of appetite or breach of Tolerance and automatic issues can be created only on a breach of appetite or breach of Tolerance one approval level is provided in the out of the box solution but multiple levels can be configured if required as well as specific criteria for example you can configure an additional approval for residual risks that have a high rating this is configured in the approval configurator module in approval configurations click on the advanced risk assessment approvals to configure the approval workflow ensure that the right table is selected different levels of approvals for varying methodologies and other criteria can be specified in the filter condition one or more approval levels can be created and approval rules configured for each level now the assessment preferences are completed the final step is to define the risk roll-up preferences risk scores are calculated across the risk statement hierarchy and entity hierarchies these methods enable stakeholders to monitor their risk posture and provide visibility of the overall aggregated risk score once the risk assessments are formed and are in monitor State the system automatically rolls up the qualitative and quantitative risk scores the Roll-Ups are calculated based on the formula selected which is set on the ram form now all the setup steps are completed lender is ready to trigger assessments to the business let's review the benefits of using Advanced risk assessment in servicenow the advanced risk assessment in servicenow digitizes the complete risk assessment life cycle providing a standardized process across the organization it automates aspects of the process including email notifications approval levels based on criteria reporting and risk aggregation the risk assessment process can be easily configured and allows multiple methodologies to be used it supports both qualitative and quantitative risk assessment methods so that risks can be analyzed efficiently and finally it Aggregates the bottom-up risk assessment scores automatically across the risk and entity taxonomy thank you for watching and we'll see you on the next how to video