foreign TA from Glide fast Consulting and today we're going to take a look at Advanced risk and servicenow which is a plug-in within the GRC irm Suite of applications so what is Advanced risk and why would we want to consider upgrading to it so the answer is a plug-in introduced in Orlando release that expands on the functionality of what I'm calling classic risk it still leverages many of the original risk tables that classic risk provides provides further functionality once an instance is upgraded to avancerous it may not revert back to Classic risk so this is something I do warn customers if they're using previous functionality from regular risk management such as risk scoring with simple impact and likelihood calculators I I do like to caveat that if we switch to Advanced risks it will no longer be able to use those features now as a service house customer's decision upgrade to Advanced risk likely stems from a desire to take advantage of features such as the advanced risk assessments more robust risk identification process risk aggregation and risk roll-up of risk scores to parent top-level risks risk events risk assessment scoping and risk assessment scheduling and we're going to get into those features a little bit more in depth here so Advanced risk assessments and scoring these are configurable multi-factor risk calculators that are available on risk assessment methodology records so what you do when you're first setting up Advanced risk is you set up your risk assessment methodology records based on the types of risks that you are assessing risk for and then you choose those applicable entity classes so we're going to in a few minutes show you how to configure that within the instance but this is really the bread and butter of advanced risk on the risk assessment methodology and the different ways we can assess risk another feature of advanced risk is risk identification so a wrist identification is the process of determining risks that could potentially prevent the program Enterprise or investment from achieving its objectives using the adverse identification workflow available as part of our Advanced rest product second line managers can design and send a questionnaire to respective business owners and based on these qualitative responses they can identify and map the relevant risks so risk identification is really about identifying those new risks within our organization that will want to put through assessment and ultimately determine a response to and monitor those risks in the coming future another feature we have is risk aggregation and roll up so we can Define top level risks and roll up the risk scores for child risks up to those top level risks now typically you'll Define a risk statement or entity hierarchies and this is how you define your parent-child relationships for the risks and you can roll up the inherent control assessment and residual risk scores individually up onto those parent level risks another feature within Advanced risks is risk event Service events are potential or actual financial and non-financial losses near misses and gains that occur within an organization most events are also known as loss events or loss entries so with Advanced risk we have a feature a risk event table and risk event records that allow us to intake risk events they can actually be reported via a service portal record producer from any employee in the organization and that risk event can be analyzed by the risk analyst team and eventually approved as a valid risk event and related to any uh previous risks that are on the risk register or a new risk could be put into the risk register as a result of a risk event being reported and the final two features of adventurous I wanted to cover was uh risk scoping and the risk assessment scheduler so we can create a risk assessment scope to Define and identify risk for an entity identify assessors and approvers for the assessments and Define the frequency of those assessments so we'll take a look at that we're scoping feature and then the risk assessment scheduler enables us to schedule risk Assessments in bulk the next feature I'd like to point out within Advanced risk is risk identification so I've navigated to a risk identification configuration record here and you'll see that we can configure an identification configuration for entity class or a table so we can generate a recidentification based either on any class or a particular record within a table now if you choose any class you'll be able to choose a Target entity class based on the type of entity that it is and then you'll be able to choose whether identification questionnaire should be included within the recent identification and also whether an inherent assessment should be performed down here you'll see the ability to choose the questionnaire from servicenows survey engine that will allow you to choose configure questions that'll be part of that questionnaire okay so as you can see we're logged in here to an instance of servicenow with the advanced risk plugin activated and the first feature I wanted to point out is the risk assessment methodologies feature where we can configure a risk assessment methodology or RAM for short which will apply to our risks by risk type so as you can see there are Ram records configured out of box actually comes out of box when you activate the plugin for different types of rams whether they apply to like it risks application risks or operational risks so if I create a new risk assessment methodology here we'll see that we can define a name a domain area for the recessive methodology we can choose what type of record we want to assess now of course often within risk we'll just want to assess a risk record and then choose the applicable entity class for those risks but another interesting feature that advanced risk allows us is to assess risks against any object in servicenow so that's any any record with any table within servicenow we can assess risk against such as like a business application record or whatnot but we'll choose uh a risk to assess against a risk record and then down here we'll see that we have ability to do an inherent risk assessment do a control Effectiveness assessment or residual risk assessment now any or all of these can be chosen for the risk assessment methodology and ultimately when we create a new risk record within the risk application and we we choose assess we go to that next stage of assess servicenow is going to generate a risk assessment record with an advanced risk and it'll leverage anything that we've configured on this methodology record here now as I mentioned when we generate a risk and then put that risk into an assessed state within the classic risk module if we do have advanced risk enabled servicenow is going to create a risk assessment record based on the uh risk assessment methodology that's configured for the entity and the entity class for that risk so I've opened up a risk assessment record here as you can see we have it applied to a company it applies to a risk record itself so this is really the uh we'll call it the parent risk that this assessment will will apply to it's in that assess phase but from here on it's going to leverage the functionality of advanced risk as we can see here we have the inherent risk score control effective score and residual risk score and ultimately this record will be put through a process and put in monitor State and this within the context of advanced risk will serve as our risk register [Music]