{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":17377,"path":"governance-risk-compliance/grc-risk-management-workspace/create-risk-stmt-workspace.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Create a risk statement in the Risk Workspace\ndescription: Create risk statements to group risks into manageable categories.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/grc-risk-management-workspace/create-risk-stmt-workspace.html\nrelease: australia\nproduct: GRC: Risk Management Workspace\nclassification: grc-risk-management-workspace\ntopic_type: task\nlast_updated: \"2026-03-12\"\nreading_time_minutes: 5\nbreadcrumb: [Create a risk framework in the Risk Workspace, Use Risk Workspace, Risk Management, Governance, Risk, and Compliance]\n---\n\n# Create a risk statement in the Risk Workspace\n\nCreate risk statements to group risks into manageable categories.\n\n## Before you begin\n\nRole required: sn\\_risk.admin\n\n## About this task\n\nWhen you create a risk statement, you can associate entity types or add additional entities to generate risks.\n\n**Note:** When any of the following risk statement fields changes: Name, Description, Reference, Category, Type, Classification, and Attestation, all the associated controls and risks are updated, and their state is set back to Draft. All the associated risk assessments also get canceled.\n\n## Procedure\n\n1. Navigate to **All** > **Risk Workspace** > **Library** > **Risk statements**.\n\n2. Click **New**.\n\n3. On the form, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName of the risk statement.\n\n
\n\nDescription\n\n\n\nDescription of the risk statement.\n\n
\n\nParent\n\n\n\nParent risk statement. You can define the hierarchy using this field.\n\n
\n\nFramework\n\n\n\nFramework this risk statement is associated with.**Note:** This field only appears if the **Migrate to Advanced Risk Assessment** property is enabled. For more information, see [Risk score rollup in Advanced Risk Assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-risk-management-workspace/risk-rollup-ara-concept.md)\n\n
\n\nCategory\n\n\n\nCategory of the risk statement. The choices are as follows:- Legal\n- Financial\n- Operational\n- Reputational\n- Legal/Regulatory\n- Credit\n- Market\n- IT\n- Project\n\n\n
\n\nLevel\n\n\n\nLevel at which the risk statement is created. For example, if the risk statement has a parent and a grandparent, then the level of this new risk statement will be 3.\n\n
\n\nAssessment\n\n\n\nRisk assessment template to be assigned to this risk statement. An assessment template is a questionnaire that is used for assessing a risk.**Note:** This field appears when you use classic risk with enabling the advanced risk property.\n\n
\n\nIssue group rule\n\n\n\nIssue group rule assigned to this risk statement for reporting. The purpose of the issue group rule is to group similar issues together into a parent issue based on conditions defined in the rule. This feature enables you to work on the similar issues at once and close out the parent issue once resolved, which will close out all the child issues.\n\n
\n\nAdditional information\n\n\n\nAdditional information for this risk statement.\n\n
4. To fill in the fields for the risk appetite section, see [Define the risk appetite for a risk statement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-risk-management-workspace/define-risk-appetite-on-risk-statement.md).\n\n5. If you're using classic risk, in the Default Scores section, fill in the fields.\n\n |Field|Description|\n |-----|-----------|\n |Inherent SLE|Single-loss expectancy \\(SLE\\) is the monetary value expected from the occurrence of a risk on an asset if there are no controls to check the event.|\n |Residual SLE|Monetary value expected from the occurrence of a risk on an asset if there are controls to check the event.|\n |Inherent ARO|Annualized rate of occurrence \\(ARO\\) is an estimated frequency of the threat occurring in one year. ARO is used to calculate annualized loss expectancy \\(ALE\\). The value in this field indicates the likelihood of the event occurring if there are no controls to check the event.|\n |Residual ARO|The value in this field indicates the likelihood of the event occurring if there are controls to check the event.|\n\n6. If you're using classic risk with the advanced risk plugin activated, in the **Risk Rollup and Tolerance** section, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nExpected ALE\n\n\n\nALE refers to the product of the ARO and the SLE. Expected ALE is the expected value of the ALE for the risk statement. Enter currency and amount for the expected ALE.**Note:** This value must be less than or equal to the **Maximum acceptable ALE**.\n\n
\n\nSum of calculated ALE\n\n\n\nThis calculation is based on the sum of calculated ALE of all the underlying risks of the risk statement and its children risk statements.\n\n
\n\nMaximum calculated ALE\n\n\n\nThis calculation is based on the maximum of calculated ALE of all the underlying risks of the risk statement and its children risk statements.\n\n
\n\nMaximum acceptable ALE\n\n\n\nThreshold value for the ALE for the risk statement.**Note:** This value must be greater than or equal to the **Expected ALE**. This value has an impact on the **Tolerance status** field.\n\n
\n\nAverage calculated ALE\n\n\n\nThis calculation is based on the average of calculated ALE of all the underlying risks of the risk statement and its children risk statements.\n\n
\n\nMinimum calculated ALE\n\n\n\nThis calculation is based on the minimum of calculated ALE of all the underlying risks of the risk statement and its children risk statements.\n\n
\n\nTolerance Status\n\n\n\nOverall risk status. This field appears when the other ALE fields are populated.\n\n
\n\nCalculated Score\n\n\n\nThe corresponding score for the calculated ALE:- Low\n- Med\n- High\n\n\n
7. In the Basel Categorization section, select the Basel Categories Hierarchy.\n\n The Basel categories are as follows:\n\n - Internal Fraud: misappropriation of assets, tax evasion, intentional mismarking of positions, bribery.\n - External Fraud: theft of information, hacking damage, third-party theft, and forgery.\n - Employment Practices and Workplace Safety: discrimination, workers' compensation, employee health, and safety.\n - Clients, Products, and Business Practice: market manipulation, antitrust, improper trade, product defects, breaches, account churning.\n - Damage to Physical Assets: natural disasters, terrorism, vandalism.\n - Business Disruption and Systems Failures: utility disruptions, software failures, hardware failures.\n - Execution, Delivery, and Process Management: data entry errors, accounting errors, failed required reporting, negligent loss of client assets.\n8. Click **Save**.\n\n9. To add entity types, click the Entity types related list.\n\n 1. Click **Add**.\n\n 2. Select the entity types to add.\n\n 3. Click **Add**.\n\n10. To add additional entities, click the **Additional entities** related list.\n\n 1. Click **Add**.\n\n 2. Select the entities to add.\n\n 3. Click **Add**.\n\n11. Click **Save**.\n\n\n## Result\n\nThe risk statement is created.\n\n## What to do next\n\nYou can continue to add control objectives, indicator templates, and information objects to the risk statement. You can also now assess the risks that are generated in the Risks tab. You can also view the hierarchy of the risks statement on the risk statement side bar. To view the complete risk profile at a glance, click the **Overview** tab.\n\n**Parent Topic:**[Create a risk framework in the Risk Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-risk-management-workspace/create-risk-framework.md)\n\n"}}