Grc Risk Management Workspace

The GRC: Performance Analytics Integration plugin provides an integration between Performance Analytics and the Risk Management and Policy and Compliance Management applications. This plugin provides more insight into organizational risk and compliance performance.

The GRC: Workbench plugin is not activated by default, it is available as a separate subscription within the GRC Suite.

Add additional reporting filters to specify at a granular level what data must be imported to the report from a table using the Management Reporting of Risk application.

A cause library is a centralized library of the possible causes that can lead to a risk event. Adding causes helps to identify the reason for a risk event and prevent future events.

A consequences library is a centralized library of the possible consequences of a risk event.

Add related business assets to a business process to gain visibility into the IT assets and their performance.

Before you can import data into your Microsoft Word document to create your disclosure reports, you must add the ServiceNow Reporting add-in to your Microsoft Word.

Using the Risk Management application, administrators can customize risk categories, risk criteria, risk management properties, and risk assessment types.

The GRC Application Risk and Compliance Overview Dashboard provides the latest view of risk and compliance aspects for the business applications that are used in an enterprise.

Use the Advanced Risk Assessment Overview dashboard for an overview of the performance of any risk assessment methodology based on the risk assessment instances.

Use the ServiceNow Governance, Risk, and Compliance (GRC) Advanced Risk Assessment feature to create an integrated risk platform. This integrated platform supports various kinds of risk assessment methodologies. It enables you to integrate risk assessment as part of your overall decision-making process.

Properties are added with activation of GRC: Advanced Risk. There are also properties that are available for the various capabilities such as risk events and advanced risk assessments.

ServiceNow Otto for Integrated Risk Management (IRM) brings AI-generated risk suggestions and summaries to Risk Management, helping risk managers discover risks faster and assessors understand risk events without writing summaries manually.

Analyze user-submitted risk events. You can add additional details to the risk event, request more information from the submitter, or reject the risk event if the event is not valid.

Analyze user-submitted risk events to determine if the risk event is valid and needs further processing.

Assess the risks on any object or record in ServiceNow. An example of object assessment is assessing change management or assessing a citation.

If you don't have the complete GRC setup for entities, risk statements, controls, and so on, even then, you can still assess the risks on any ServiceNow record or object. An example of object assessment is assessing change management or assessing a citation.

A user with the sn_risk.manager role must approve a valid risk event. If any risk approver rejects the event, the state of the risk event changes to rejected.

The Risk Workspace offers an enhanced and a simplified user experience for users to perform Advanced Risk Assessments. You can quickly access the risk assessments assigned to you or your group from the GRC Risk Portal or the Risk Workspace.

Risks start in a Draft state then move to the Assess state.

Assign the project risks to the relevant stakeholder for assessment. You must manually assign the risks to the stakeholders.

Use the classic risk assessment and assess the risks in your organization.

After the review of a policy exception request and before deciding to approve or reject a request, the compliance manager may choose to request a risk assessment by the risk manager.

Assess the project risks by responding to predefined factors or questions. Arrive at a risk score for the project.

Assess the risks that you have configured and reassign the risks to relevant approvers.

You can associate entities, entity types, and indicator templates, at any level of the risk statement hierarchy. Creating this association is useful for risk managers while assessing risks.

You can associate Performance Analytics indicators with risk statements and policy statements to analyze trends related to the risk or policy.

You can associate Performance Analytics indicators with risks and controls to analyze trends related to the entity that risk or control belongs to.

After the inherent assessment is completed, you can associate risks, citations, policies, and controls with the risk identification record. You can identify what methods to use to mitigate the risks.

Train a similarity solution definition that uses machine learning by activating the Governance, Risk, and Compliance: Predictive Intelligence plugin. The solution enables the system to display similar risk events automatically.

The fields of the automated metric definition form are explained in this topic.

The Basel dashboard is a medium to share the Basel reports with external regulators for Basel regulations. This dashboard is useful for banking and financial domains where it is compulsory to share the Basel reports.

Business operational risk managers are the first lines of defense for each individual line of business. They are responsible to manage the risk posture of their specific business units.

A business process is an activity or a set of activities that can accomplish a specific organizational goal.

Various roles are available for business process users and managers.

The Risk Overview is contained in the Risk Management application and provides an executive view, allowing risk managers to quickly identify areas of concern by pinpointing entities with known high risk.

The Risk Management product provides a centralized process to identify, assess, respond to, and continuously monitor Enterprise and IT risks that may negatively impact business operations. The application also provides structured workflows for the management of risk assessments, risk indicators, and risk issues.

The fields of the calculated metric definition form are explained in this topic.

By using the Governance, Risk, and Compliance: Predictive Intelligence plugin, you can predict the risk statements for your orphan risks (the risks that don't have risk statements) on the risk records for your organization. You can then identify the correct risk statement for the risks and then aggregate them into manageable categories.

Change the default name, color, and icon that appear for the risk appetite status in the Advanced Risk application.

You can view your risk data visualizations in different colors for a quick overview of your risks.

Close a risk event to complete the risk events life cycle. A user with the sn_risk.manager role must close the risk event after verifying that all associated open issues and remedial tasks are closed.

Activating the GRC: Advanced Risk (sn_risk_advanced) plugin adds or modifies several tables, user roles, and other components. The Advanced Risk plugin enables you to perform advanced risk assessments and manage risk events.

Create automated factors to automatically fetch data from other data sources such as tables or database views.

Configure the business domain roles so that users of a particular domain can select the domain for which they want to import the data. Only those users who are added during the configuration are able to view the domain on the Microsoft Word document.

Configure and publish a control effectiveness assessment to assess the effectiveness of controls in mitigating risks.

Configure a feedback integration setup in the Advanced Risk application to define the table on which you want to use Parallel Review and Feedback. This setup enables you to define the workspace, reviewer, and respondent for creating feedback on the table records.

Specify the formula context, the tables, and the identifiers before you can build a formula.

Configure and publish an inherent assessment in the Advanced Risk application to assess the inherent risks in your organization.

Configure the Matrix report registry to select the base table. You can create a relationship of the base with the target table to configure the details of the report for an entity-related record or a landing page.

Configure a risk assessment methodology (RAM) in the Advanced Risk application so that you can assess the risks or objects in your organization.

Configure and publish a residual assessment in the Advanced Risk application to assess the residual risks in your organization.

Set up the advanced risk assessment properties so that you can configure and customize the risk appetite and tolerance in the Advanced Risk application.

Configure risk event integration with other upstream ServiceNow applications. This integration enables all users in an organization to report and track the risk events.

Within a risk assessment methodology (RAM), configure the heatmap visualization for inherent and residual assessments. Use different heatmaps for different risk assessment methodologies.

Before assessing an application, specify the target application where the risk identification must be initiated.

Configure the Risk Management application to use the features it provides for the complete risk management of your organization.

Configure and publish a target assessment in the Advanced Risk application to assess your desired future risk level. By configuring a target assessment, you enable the assessors and approvers to perform a target risk assessment in the Next Experience.

You can configure GRC: Metrics to meet the needs of your organization.

Continuous monitoring for risks is a feature integration between the GRC: Risk Management and the Security Operations Vulnerability Response products, which uses indicators to quickly identify high impact vulnerabilities based on business impact.

Use the Control Assessment form in the Advanced Risk application to assess the effectiveness of controls in mitigating risks.

Convert any metric data into a preferred reporting unit.

Create a copy of a published factor to make minor modifications and then reuse the factor.

Modify your risk assessment methodology (RAM) and factors by creating a copy of the record. The option to copy allows the system to create a true copy of the underlying record including all the related lists. This action saves the time of risk administrators as they do not have to create the records from the beginning each time.

Copy existing thresholds to quickly create similar threshold configurations for the same metric or metric definition.

Create and run a basic risk indicator to identify the possibility of a future adverse impact on your organization. Indicators are an early warning system and they enable you to take preventative action on the risks. Basic indicators are automated indicators based on an indicator source.

Create a business process and define the owners, approvers, business criticality, and review frequency for the process.

Create feedback on a record or fields in a record in the Advanced Risk application. The feedback enables you to recommend improvements related to data integrity, compliance, operational procedures, and other pertinent areas.

Build your own formula using either entities or metric definitions.

Create and run a manual risk indicator to identify the possibility of a future adverse impact on your organization. Indicators are an early warning system and they enable you to take preventative actions on risks. In a manual indicator, the results are manually gathered using task assignments.

Create a metric to perform calculations on your data.

A risk event might require associated tasks. Unless these tasks are created and eventually closed, the risk event cannot be closed.

Create and run a scripted risk indicator to identify the possibility of a future adverse impact on your organization. A scripted indicator enables you to write your own script to run the indicators. Indicators are an early warning system and they enable you to take preventative action on the risks.

Create multiple strategies with various action items for each risk response task. Action items help you to understand and focus on specific steps needed to manage risks.

The risk manager can create a set of questions for each risk assessment.

Use the Risk Assessment Designer to create and edit metric types, use different metric types for different risks, select multiple respondents for a risk assessment, as well as change scoring parameters. The Question Bank offers a library of questions for various categories, so you do not have to build each questionnaire from scratch.

Create an assignment configuration for a manual metric definition to have data owners dynamically assigned to metrics.

Create a business process in the Risk Workspace and define the owners, approvers, business criticality, and review frequency for the process.

Associate risk statements to control objectives in the Risk Workspace. This association helps you to manage your risks by ensuring that the risks have mitigating controls.

Use the Create new feedback form to provide feedback on a record or fields in a record.

Create feedback on a record or fields in a record from the record side panel using the Advanced Risk application. The feedback enables you to recommend improvements related to data integrity, compliance, operational procedures, and other pertinent areas.

Create feedback on a record or fields in a record, to recommend improvements related to data integrity, compliance, operational procedures, and other pertinent areas, such as disposition and accountability.

Create the Matrix report configuration by naming the report, choosing a display type (Landing page or Record page), and setting filter conditions on the base table.

Use the Create New Action Item form to define the plan of action, assign responsibilities, set priorities, and establish milestones for the action item.

Create a risk event entry to determine the monetary or non-monetary impact of the risk event. A risk event can have multiple risk event entries.

Use the Create New Metric form to create a metric.

Create an Operational Riskdata eXchange (ORX) external risk event to share the risk event of your company with other organizations. This exchange of risk events information acts as a learning for other organizations in the industry and prevents them from making the same errors.

GRC managers create entity classes representing the types of things that are part of the dependency model. Reports can be filtered to define relationships between the different enity classes. An entity class defines what a entity actually is.

Simplify the groupings of related lists on a record page and customize them to your specific needs, assigning meaningful names in the process. This configuration enhances readability and user experience when interacting with the forms.

Managers create relationships between entity classes using the GRC: Workbench to build out the dependency map and better understand how entities relate to one another.

Train and use the machine learning solution by activating the Governance, Risk, and Compliance Predictive Intelligence plugin. The solution enables the system to automatically suggest correct assignees to route issues. These suggestions reduce the time spent on deciding who should own the issue.

Create a risk assessment scope to identify risks for an entity, define assessors and approvers, set assessment frequency, and initiate assessments using the Risk Management application.

Create a risk assessment scope to define and identify risks for an entity. Identify assessors and approvers for assessments, and define the frequency of assessments.

Create a risk assessment project to perform assessments on multiple risks and controls simultaneously using Risk Workspace. You can define the project context, including one or more assessable entities, Risk assessment methodology (RAM), project name, description, and identify and add stakeholders.

Create a library of risk color styles to use for different assessment types and matrixes. A risk color style is a combination of a background color and a text color. The color styles help maintain consistency when you configure risk assessments.

Create a risk event entry to determine the monetary or non-monetary impact of the risk event. A risk event can have multiple risk event entries.

Automatically assign the risk event owner, create and assign issues, and route approvers based on entity, event type, category, and impact thresholds in the risk event response template.

Create a risk event in the Risk Workspace. Risk events are potential or actual financial and non-financial losses, near misses, and gains that occur within an organization.

Create risk frameworks to group risk statements into manageable categories and generate risks. After the risks are generated, you can identify methods to mitigate them.

Create a risk indicator to identify the possibility of a future adverse impact on your organization. Indicators are an early warning system, and they enable you to take preventative action on the risks.

Create a risk response task to define plan of actions, assign responsibilities, set priorities, and establish deadlines to ensure effective management of the assessed risks.

Risk managers establish parent and child relationships on the risk statement form.

Create risk statements to group risks into manageable categories.

Risk managers can create risks directly from the GRC: Workbench.

Create a smart assessment template for risk identification using the Smart Assessment Engine application.

Create a test plan to document the control testing procedure. You can create a test plan from scratch or based on a test template to describe how a feature is to be tested.

Customize the available threshold colors by enabling inactive colors in the Color dictionary.

Create group factors to evaluate and assess risks on a risk assessment instance.

Create manual factors to evaluate and assess risks on a risk assessment instance.

Define the risk appetite on the entity records in the Risk Management application to evaluate all the possible risks and to set the boundaries for the acceptable and unacceptable risks for your business.

Define the risk appetite on the risk statement records in the Risk Management application to evaluate all the possible risks and set the boundaries for the acceptable and unacceptable risks.

Define the risk appetite on the risk records in the Risk Management application to evaluate all possible risks and to set the boundaries for acceptable and unacceptable risks.

Create scripted automated factors that use a script to fetch data from ServiceNow records or from external sources. During risk assessment, scripted automated factors automatically calculate and provide the responses for factors.

Define a threshold limit for assigning risk event approvers. A threshold limit is defined to determine if a risk event needs an approver.

If a risk assessor is unavailable to perform a risk assessment, the assessor can appoint a delegate to perform the risk assessment for a specified time period. The ServiceNow AI Platform enables you to appoint your delegates.

Deleting an entioty class, deletes all relationships below it.

When deleting entity dependencies, only the relationship between the entities is deleted. The entities themselves remain unmodified.

When deleting risk dependencies, only the relationship between the risks is deleted. The risks themselves remain unmodified.

Domain separation is supported for Risk Management. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Before you run Advanced Risk in your instance, you must download it from the ServiceNow Store.

Edit a formula in a calculated metric definition to update the calculation logic or apply changes to historical data.

A metric consists of several components such as metric definition, metric data, metric definition data, metric data tasks. All of these elements or parts contribute to the metric collection process in various ways.

Elevate a project risk to an enterprise risk if the project risk has an impact on the enterprise.

The integration of GRC tasks with the Employee Center makes it easier for employees to complete the GRC tasks easily and effectively. This integration allows them to report risk events or request policy exceptions and makes GRC more useful in the organization.

In the new workspace, several enhancements have been made to ease the way you perform your daily tasks. The user experience enhancements are useful for new GRC users or users who do not have the complete experience of GRC.

Entity classes are used to tag your entities and to provide a complete view of the risk status in your organization.

By creating entity tiers, you can prioritize the entity classes.

A metric is used to measure and evaluate the effectiveness of your organizational processes. A metric or a combination of metrics can provide an insight into a system, component, or process.

Factors are questions that you can use to analyze risks. Factors appear on a risk assessment instance.

Use the Feedback dashboard to track and manage feedback using the Risk Workspace. The Feedback dashboard organizes feedback according to its status, importance, type, and other specific factors.

Use the Feedback Details form to provide feedback on a record or fields in a record from the record side panel.

Use the Feedback integration configuration form to define a setup for the Parallel Review and Feedback.

As a risk user, filter data in the risk heatmap workbench to get a granular view of your risks.

Use the Financial Impact Approval Thresholds form to define monetary thresholds that trigger approval requirements for risk events and to configure how approvers are determined when those thresholds are met.

Connect integrates with Risk Management providing an overlay to the standard interface, allowing users to participate in conversations while they work and collaborate on the risk record.

In a calculated metric definition, you can create formulas to perform calculations for any data that you may require.

Generate an AI risk event summary using the ServiceNow Otto for IRM application. Approvers get key insights to understand the context quickly and spend less time creating summaries manually.

Generate an AI risk assessment summary based on your inherent risks, residual risks, target risks, and control effectiveness data by using the ServiceNow Otto for IRM application. Approvers get key insights to understand the context quickly, and you spend less time creating summaries manually.

Generate an AI risk event summary using the ServiceNow Otto for IRM application in the Risk Workspace. Approvers get key insights to understand the context quickly and spend less time creating summaries manually.

Several properties, tables, and roles are installed with the GRC: Metrics application.

The Risk Overview dashboard provides an executive view into the status and workflows of inherent and residual enterprise and IT risks. The user can drill down into risks by framework, response, and exception.

Platform Analytics Solutions contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

Use the Governance, Risk, and Compliance: Risk Management application to continuously monitor and identify high-impact risks, improve your risk-based decision-making, and reduce reaction time. The application also provides structured workflows for the management of risk assessments, risk indicators, and risk issues.

Use a Virtual Agent chatbot to report risk events from the Service Portal. A virtual agent chatbot helps customers to quickly report a risk event. The chatbot assists the customers by saving their time. The information exchanged during the conversation flow enables the chatbot to fulfill a user request or assist the user in completing a task.

The GRC: Workbench utilizes CMDB information to show the upstream and downstream relationships across all applications. CMDB information is one of the sources. These relationships enable consistent risk mapping and modeling across the enterprise.

Identify and consolidate risks using the Risk Suggestion AI agent through a conversational assistant. This feature helps streamline risk discovery, eliminate duplicates, and provide a comprehensive list of risks relevant to the entity.

Import and insert data such as Risk data points and reports into a Microsoft Word report document from a ServiceNow instance. You can only import and insert the data that is configured in your reporting configurations.

The GRC Advanced Risk plugin contains various indicators.

The GRC Audit Management plugin contains various indicators.

The GRC Profiles plugin contains various indicators.

The GRC Policy and Compliance Management plugin contains various indicators.

The GRC Risk Management plugin contains various Performance Analytics indicators.

Information objects are a part of the information portfolio management capability in the Application Portfolio Management application.

Use the Inherent Assessment form in the Advanced Risk application to assess the inherent risks in your organization.

Initiate a Sidebar chat to collaborate among different stakeholders to brainstorm solutions, clarify details, or coordinate actions regarding the feedback received.

Install the ServiceNow Reporting add-in to your Microsoft Word document. This add-in is required to import reports and data from your ServiceNow instance to Microsoft Word documents to create risk reports.

You can install the Risk Management application (com.sn_risk) if you have the admin role. If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.

Learn how to use the Review and feedback workflow to enable the 2nd and 3rd line managers to review records, capture feedback, and track the closure of feedback.The Parallel Review and Feedback workflow enables second and third line managers to review records and capture feedback at any stage. This facilitates collaboration across management lines and ensures feedback is tracked through closure.

When customers migrate to advanced risk assessments, the system replaces the legacy risk life cycle and shows a new section called Assessment Summary on the Risk form. This section is useful for the risk managers as it provides the overall visibility of the assessment results.

Extend the capabilities of Risk Management such as Advanced Risk Assessment and help other applications with risk identification and risk assessments.

The Management Reporting of Risk (sn_grc_mgmt_report) integration provides reporting capabilities to Risk reporting managers to report ServiceNow Risk Management system data, list reports, charts, pivot, and multi-pivot reports using Microsoft Word.

Train a similarity solution model that uses machine learning so that the system can automatically suggest how to route issues to the correct assignee. Automatic routing suggestion reduces the time spent on deciding who should own the issue.

The issues landing page in the Risk Workspace provides logged-in managers and users with all the information they need to manage issues on a single page. The landing page features actionable insights, quick action buttons, filters, and access to open issue triages.

Issues can be created manually to document audit observations or remediations, or to accept any problems. They are automatically generated from indicator results, attestation results, or control test effectiveness.

You can create and associate multiple risks to the same risk statement and entity combination. This association benefits the risk managers and the entity owners.

Entities are one of the most fundamental and crucial elements for using Governance, Risk, and Compliance. Entities can be people, processes, departments, applications or objects that are examined for risks.

Indicators are an important tool used to manage your organization's risks. Indicators collect data to monitor controls and risks, and to collect audit evidence. Indicators monitor a single control or risk. They are used to enhance and facilitate the monitoring, mitigation, and reporting of risks.

Risk events are potential or actual financial and non-financial losses, near misses, and gains that occur within an organization. Risk events are also known as loss events or loss entries.

Detailed explanation of the fields on the manual metric definition form.

Use the Matrix report configuration form to configure the Matrix report in the Risk Workspace.

Matrix report is a structured report that you can configure to view in a grid or table format in the Risk Workspace. You can use the matrix report to access and analyze the risk posture of your organization using entity-related data, such as risks, controls, KRIs, and events.

The metric data table enables data collection for metrics across the organization using an easy-to-use interface like a spreadsheet with multiple filters and a task management workflow.

Use the Metric Definition Threshold form to define performance limits for a metric and control how the system responds when those limits are reached.

A metrics manager defines the metrics by creating a metric definition. A metric definition is a template-level record. In the metric definition, you set the core properties of the metric, such as unit, direction, nature, precision, and category. The metrics collect the scores, and these scores get rolled up into the metric definition.

Assign unassigned indicator tasks to a member of your assignment group. An indicator task is related to a Risk record that is assigned to your compliance group.

Open the GRC Mobile application and add a ServiceNow AI Platform instance with Risk Management to your mobile device.

Process pending approval requests for Risk Management acceptance tasks that are submitted to you.

Reassign overdue risk assessments to another member of your assignment group.

Assign unassigned issues to a member of your assignment group. Navigate through the record to view more details about the Risk Statement, the Risk record, and Remediation Tasks associated with an issue.

As a risk manager, use your Android or iOS mobile device to manage your work.

Reassign overdue Risk Management issues that are assigned to your assignment group.

Assign an unassigned remediation task to a user of your group. Edit the fields including the Extend by days field. Navigate through the record to view more details about the Risk Statement, the Risk record, and the Issues associated with a Remediation Task.

Set additional filters to limit the number of records that are displayed on a screen. Filtering records in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.

The following checklist includes the set up tasks that you are required to complete in your ServiceNow AI Platform instance and on your mobile device. Complete these set up tasks prior to using the GRC Mobile application to view the Risk Management application on your mobile device.

Modify the messages displayed on the risk assessment form using the Advanced Risk application. Modifying system messages enables personalized and consistent messaging for users, aligning with their preferences and specific requirements.

A risk assessment project can scope risks across multiple entity classes and multiple entities at the same time.

The Operational Risk Management dashboard enables an entity owner, with the role sn_risk.user, to view the complete risk posture for the enterprise in a single consolidated report. This dashboard makes it easy to analyze the risk posture efficiently and take necessary corrective actions to ensure that there are no losses.

Use the Performance Analytics (PA) dashboards to view the comprehensive data for risk events and risk hierarchy. Use the Analytics Hub to view data for any time period.

You can link Risk Management risk statement and risks to Performance Analytics indicators, breakdowns and thresholds. You can associate Performance Analytics indicators with risk statements, and risks to view scorecards and trends and analyze current conditions and trends.

Conduct risk assessments to assess inherent risks, effectiveness of controls, residual risks, and target risks in the Risk Workspace application. You can define risk responses that enable you to manage and mitigate the risks identified during the risk assessment process.

Perform assessments on multiple risks and controls simultaneously in a risk assessment project using Risk Workspace. You can assess inherent risks, effectiveness of controls, residual risks, and target risks. You can define risk responses that enable you to manage and mitigate the risks identified during the risk assessment process.

Perform assessments on multiple risks and controls simultaneously in a risk assessment project using the grid view. You can assess inherent risks, effectiveness of controls, residual risks, and target risks. You can define risk responses that enable you to manage and mitigate the risks identified during the risk assessment process.

The project risk dashboard is useful for project managers and the enterprise risk managers. Using this dashboard, the project managers and enterprise risk managers can view the risk performance and the overall risk posture. This dashboard helps risk managers to reduce the overall risks in an organization.

Use the metric tasks module to provide responses for multiple metrics in an easy-to-use format.

Risks are scored during an assessment and then a rating is derived. Ratings are of three kinds: qualitative, semi-quantitative, and quantitative.

Validate that Advanced Risk still works after you make any configuration change, such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Validate that Risk Management still works after you make any configuration change, such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Several types of components are installed with activation of the Risk Management plugin, including tables, user roles, and scheduled jobs.

Properties are added with activation of GRC: Risk Management.

The risk library contains all risk frameworks and risk statements. Risk frameworks are used to group risk statements into manageable categories, while risk statements group the individual risks. The risk register is the central repository for all potential risks that could occur at any time, anywhere in the organization.

Roles are added with activation of GRC: Risk Management.

Tables are added with activation of GRC: Risk Management.

Reassess a risk assessment project to assess any completed risk assessment project. It verifies that risks are reviewed and updated to reflect new insights or changing conditions, maintaining alignment with organizational goals.

Reassign assessors for multiple in-progress risk assessment projects simultaneously to minimize disruptions during stakeholder transitions.

Reassign one or more risk assessments that are new or already in progress to a different assessor from the In Progress Assessments list.

A recommendation engine is a system that suggests products, services, and information to users based on data analysis. A recommendation engine boosts revenues and other essential metrics.

Create relationships between risks to better understand how risks affect each other and how they affect the enterprise.

Reopen closed risk events to identify and address overlooked or underestimated risks, updating existing risk events instead of creating another risk event.

When you identify any deficiencies in the controls or improvements that can be made in the organization policies, report an issue from the ServiceNow, Inc. Service Portal.

When you identify any event that might have a financial or non financial impact on your organization, report it from the ServiceNow, Inc. Employee Center. You can also report any event that has already occurred with a financial or non financial impact.

If risk event integration is configured, users can report risk events from any upstream application such as IT Incidents. This ability to report risk events saves the time of users and helps to prevent losses for organizations.

Report a risk event from the Risk Portal. The Risk Portal provides an easy method to quickly report risk events.

When you identify any event that might have a financial or non financial impact on your organization, report it from the ServiceNow, Inc. Service Portal. You can also report any event that has already occurred with a financial or non financial impact.

The reporting view provides an overview of all completed assessments under a specific Risk Assessment Methodology (RAM). It consolidates assessment data such as factor responses, scores, issues, controls, and associated risks into a single structure.

Use the Residual Assessment form in the Advanced Risk application to assess the residual risks in your organization.

Respond to a questionnaire about an application for risk assessment.

Provide comments or explanations regarding the submitted feedback using the Advanced Risk application. You can either remediate or reject the feedback, provided that there’s proper justification.

Retire a risk assessment methodology (RAM) that is no longer used. Retiring unused RAMs makes it easier to manage the active RAMs for the risk administrator.

If a new business process has identified approvers, then the approvers must review and approve the process before it can be published. The approvers can also reject or delete the process as necessary.

Review the feedback response and take further actions using the Advanced Risk application.

The Parallel Review and Feedback workflow outlines the systematic process by which the solution facilitates the submission of feedback on a record or specific fields within a record. Feedback could be related to any improvement or recommendation at a record level, such as data integrity, compliance, and operational procedures.

Review a metric data task and then either approve or reject the task based on your review.

Compute the overall risk score for an application by performing an advanced risk assessment. After the IT application owner responds to the questionnaire, a risk manager reviews the responses and performs the inherent assessment.

Review calculated metric definitions by viewing a structured and visual representation of the entire calculation chain. By using a formula tree, you can access the calculation details and view how the different metrics and emission factors are interconnected.

Manage digital risks of business applications easily by integrating GRC with business applications. By integrating, you get real-time insights into the digital risk posture of business applications, have improved communication between application owners and IT risk managers, and can reduce workloads.

Manage your project risks by using the Project Risk Assessment capability. Risk administrators, projects managers, and risk owners can manage the complete project risk life cycle by using the Project Risk Assessment capability.

Learn about the risk appetite fields on the Entity form. Use these fields to define the risk appetite, evaluate all the possible risks, and set the boundaries for the acceptable and unacceptable risks in the Risk Management application.

Learn about the risk appetite fields on the Risk Statement form. Use these fields to define the risk appetite, evaluate all the possible risks, and set the boundaries for the acceptable and unacceptable risks in the Risk Management application.

Learn about the risk appetite fields on the Risk form. Use these fields to define the risk appetite, evaluate all the possible risks, and set the boundaries for acceptable and unacceptable risks in the Risk Management application.

You can configure the risk appetite feature in the Advanced Risk application.

You can define a risk appetite and tolerance within your organization by using the Advanced Risk application. A risk appetite and tolerance enable your organization to define the boundaries for acceptable and unacceptable risks.

As users of Privacy Management, you can perform advanced risk assessments with a limited set of features even if you do not have the complete license for Integrated Risk Management.

Use the Risk Assessment Methodology form in the Advanced Risk application to specify the types of risk assessments and the entities on which the risk assessment is performed.

You can perform assessments on multiple risks and controls simultaneously by creating a risk assessment project. Risk assessment project enables assessors to review multiple risks and controls to understand their potential impact, likelihood, and associated mitigation strategies.

Create a risk assessment scheduler and assign it to the risk manager. A risk manager can then identify the entities and the risks within the entities for bulk initiation of risk assessments.

Risk assessments are surveys to determine risk. The Risk Assessment Designer provides a single interface that users can use to create, and edit attestations, as well as change scoring parameters.

Use the Risk Event Response Template form to define assignment rules. Rules automatically assign owners, approvers, issues, and Root Cause Analysis (RCA) tasks to risk events based on entity, event type, category, and impact thresholds.

As an operational risk manager, if you opt to use the classic risk assessment to assess the risks in your organization, you can view the risk heatmap to get an overview of the risk posture for your organization.

As an operational risk manager, you can visualize the risk details and better understand the risk posture of your entity by using the risk heatmap workbench in the Advanced Risk application.

As an operational risk manager, you can configure and manage your risk heatmaps in the Risk Workspace.

Starting with New York, risk managers can create hierarchies that include different types of risk (operational risk, IT risk, or strategic risk). Once the underlying risks are assessed, the risk scores are automatically rolled up across the risk statement hierarchy, providing better tactical and strategic decision-making.

The risk identification dashboard is useful for risk managers and helps them to keep a track of various records or objects which are in transit in the risk identification workflow.

Workflows provide step-by-step guidance for completing the risk identification process in the GRC Risk Workspace.

Use the steps in the Risk Management application checklist to download the Risk Management from the ServiceNow Store, and get it ready for operation. Mandatory and optional setup steps, as well as an implementation checklist are provided to simplify the setup.

When you migrate to advanced risk assessment, you can view the various states of risks and take the necessary actions from the risk form.

Reference topics provide additional information such as tables, roles, and properties that are installed with the Risk Management application.

The GRC Risk Portal is a simplified interface that enables the GRC business users to view their tasks and their group's tasks. The Risk Portal also enables users to report risk events.

The risk register contains the information about identified risks, results of risk analysis such as risk scores, and risk response plans. The risk register enables you to monitor and control the risks of your organization.

A risk response is the strategy used to deal with risks after the risks are assessed.

In Advanced Risk Assessment, risk scores are calculated across risk statement hierarchy, entity hierarchy, or a combination of both. These methods enable stakeholders to monitor their risk posture and provide visibility of the overall aggregated risk score.