Analyze a risk event · SN Doc Reader

Analyze user-submitted risk events to determine if the risk event is valid and needs further processing.

Before you begin

Role required: sn_risk.manager

About this task

When you analyse a risk event, you add more relevant details to the risk event that is submitted. During analysis, you can either reject the event if the risk event doesn't appear to be an actual risk event, or request more information if the information is insufficient.

Procedure

Navigate to All > Risk Events > All Events and open the risk event that you want to analyze.

Alternatively, you can also navigate to Risk Events > New Events.
On the form, review the fields and edit them as necessary.

Field	Description
Name	Name of the risk event. Edit the name of the risk, if necessary, to provide a more intuitive name.
Number	Number of the risk event. This field is automatically set.
Discovered by	The person who discovered the risk event. Edit the Discovered by field, if necessary.
Opened by	Person who created the event.
Primary entity	Entity that bears the loss. This entity is visible to management for reporting.
Owning group	Group responsible for monitoring the event to closure.
Owner	The person who owns the risk event. A risk manager can be an event owner. If the owning group is specified, the owners are filtered from the owning group.
State	State of the risk event. This field is automatically set.
Substate	Substate of the event. This field is automatically set.
Event type	Type of event. You can edit the event type, if necessary. For example, if during analysis you observe that the event type isn't a financial impact, you can edit the entry.
Sub type	Event sub type. You can edit the sub type, if necessary. For example, if during analysis you observe that the event type isn't an actual event but a potential event, you can edit the entry.
Category	Event category. You can edit the category to apply one of the following options:- Personal: For example, any physical harm caused to an employee. Legal: For example, an employee is found conducting business that is a conflict of interest. Information Security: For example, a theft, burglary, or system crash. Human Resources: For example, sensitive lawsuits by an employee against another employee.
Approvers	The person who approves the risk event. Any user with the sn_risk.user role can approve the risk event.
Cost center	Corresponding account number of the entity.
Description	Detailed description of the event in this field.
Dates
Date of occurrence	Exact day, month, and year when the event occurred. For example, a mortgage was lent against a property that didn't comply with the building regulations on August 12, 2019.
Date of discovery	Date that the event was first discovered or noticed. For example, the mortgage was discovered on August 24, 2019.
Date of first recognition	Date that the event was first recognized and entered in the book of accounts. For example, the loss entries were entered in the firm’s book of accounts on August 26, 2019.
Loss/Gain Estimates
Expected loss	Amount of loss expected. Expected loss is the probability weighted average of all possible losses. This amount is based on the user’s judgment of the expected amount that the organization might lose.
Potential loss	Amount expected to be a potential loss due to the risk event. This amount is the maximum loss an entity can incur due to the loss from the risk event.
Event Analysis
Cause	Primary reason why the risk event occurred.
Cause description	Brief description about why the risk event occurred.
Consequence	Consequence of the risk event. For example: Regulatory fines can be imposed as a result of the risk event.
Actions taken	Remedial actions that were taken to address the issue. This is the initial record of the event.
Credit/Market Risk
Boundary event	Option for a boundary event. A boundary event is an operational risk event which leads to a consequence, such as a financial loss in another risk category.
External risk type	Credit: Credit risk is the possibility of a loss resulting from a borrower's failure to repay a loan or meet contractual obligations. For example, when lenders offer credit cards, or loans, there's a risk that the borrower might not repay the loan. Market: Market risk is the possibility of an investor incurring losses due to factors that affect the performance of the financial markets in which the investor is involved. For example, a recession might impact the entire market.
External risk reference	ID for reconciliation in the book of accounts. Specify the IDs for reconciliation purposes. The credit and market risk systems are different.
Additional Classification
Used in modeling	Option to share these risk event records with external systems where they want to perform advanced analysis using simulation techniques such as Monte Carlo simulation.
Full rapid recovery	Total loss recovered. Select if the total loss is recovered within a short duration and doesn't impact the organization. Note: Generally, a short duration refers to five working days, but this value can be configured according to your requirements.
Financial gain	This option is automatically selected if the risk event meets one of the following conditions.- Risk event is a potential event and the Expected loss field or the Potential loss field has a negative value because of the gain. Risk event is an actual event and the Net loss field has a negative value.
Near miss	This option can either be modified or can be automatically set based on the event type. If the event sub type is Actual, and the Full rapid recovery option is selected, the Near miss option is automatically selected.
Reason for near miss	Reason which prevented the risk event from incurring the loss. If the event type is Potential, select the Near miss option and in the Reason for near miss field, enter the reason why the event was a near miss
Confidentiality
Note: This section only appears when: The sn_grc.enable_record_confidentiality property is enabled under GRC properties. The risk event is in New or Analyze state
Confidential	Option to mark the risk event record as confidential.
Allowed users	Users who can view the risk event. Note: By default, the risk event owner and the logged in user are added to the list of confidential users.
Allowed groups	Groups that can view the risk event.
Summary
To understand how the values in this section appear, refer to the example given after this step.
Direct amount	The aggregated sum of all direct losses. This field is automatically set.
Additional cost	The aggregated sum of all additional costs. This field is automatically set.
Gross loss	Sum of all direct losses, indirect amounts, and additional costs. This field is automatically set.
Net loss	The net amount of the loss. This field is automatically set.
Indirect amount	The aggregated sum of all indirect losses. This field is automatically set.
Rapid recovery amount	The aggregated sum of the amount that was recovered rapidly. This field is automatically set.
Recovered amount	The amount to be recovered for the risk event. This field is automatically set.
Non financial impact	Impact of the event when it does not have a monetary loss. The choices are as follows:- None Low Medium High
Activity
Additional comments	Provide additional comments that you may have about the risk event.
Work notes	Option to provide work notes for reference. Work notes are not visible to the risk event creator.

The values in the Summary section, the values in the fields are calculated in the Event Impacts related list. For example, consider that a firm has a fire outbreak. This event can result in multiple direct and indirect impacts such as loss of information and business.

If you enter the value of a direct impact as **$2000**, then the **Direct amount** field reflects the same value. If you enter two indirect amounts, each with a value of **$300** and **$500** respectively, then the **Indirect amount** field reflects a value of **$800**.

If an external agency is hired to address the root cause of the fire outbreak, the cost incurred reflects an additional cost.

If the firm was able to recover a part of the cost of the event in five working days, then the **Rapid recovery amount** field reflects the same amount.

The **Gross loss** field reflects the total loss incurred by the event.

The currency conversion rates impact the values displayed in the Summary related list. For example, if you enter a value of **300** Japanese Yen as the recovery amount, you see the amount in the concurrent USD value of **2756** in the Summary related list. This conversion occurs because the currency conversion rates are applied from the Exchange Rate table. For more information on how the values in the exchange rate table are calculated, see [Use your own currency-conversion rates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/t_UseYourOwnConversionTable.md).

To send the risk event for approval, click Request Approval.

Parent Topic:Use Risk Events