{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":17504,"path":"governance-risk-compliance/grc-risk-management-workspace/risk-assessment-methodology-form.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Risk Assessment Methodology form\ndescription: Use the Risk Assessment Methodology form in the Advanced Risk application to specify the types of risk assessments and the entities on which the risk assessment is performed.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/grc-risk-management-workspace/risk-assessment-methodology-form.html\nrelease: australia\nproduct: GRC: Risk Management Workspace\nclassification: grc-risk-management-workspace\ntopic_type: reference\nlast_updated: \"2026-03-12\"\nreading_time_minutes: 6\nbreadcrumb: [Configure a risk assessment methodology, Perform Advanced Risk Assessment, Use, Risk Management, Governance, Risk, and Compliance]\n---\n\n# Risk Assessment Methodology form\n\nUse the Risk Assessment Methodology form in the Advanced Risk application to specify the types of risk assessments and the entities on which the risk assessment is performed.\n\nSee the following table for a description of the field values.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName of the risk assessment methodology \\(RAM\\). For example, Organizational risk assessment.\n\n
\n\nDomain area\n\n\n\nDomain area of the RAM. This field is automatically set to **IRM**.\n\n
\n\nState\n\n\n\nState of the RAM. This field is automatically set to **Draft**.\n\n
\n\nAssessment Context\n\n
\n\nAssess\n\n\n\nAssessment context that you can select:- **Risk**: Performs the assessment for an entity and the risk statement that is related to it.\n- **Object**: Performs an assessment on any ServiceNow record. For example, users can perform an Exception Risk Assessment or a Change Risk Assessment directly on those respective tables.\n\n
\n\nApplicable entity classes\n\n\n\nAll entity classes that the RAM applies to, such as the business services, assets, or business applications. This field appears only when **Risk** is selected from **Assess**.\n\n
\n\nApplicable Record Types\n\n\n\nTables on which you want to perform the assessment. You can select multiple tables and associate them to the RAM. This field appears only when **Object** is selected from **Assess**.**Note:** You can add multiple objects or tables to a published RAM, but can’t remove them after the RAM is published.\n\n
\n\nWorkflows\n\n
\n\nInherent risk\n\n\n\nOption for assessing an inherent risk.\n\n
\n\nControl effectiveness\n\n\n\nOption for assessing the control effectiveness.\n\n
\n\nEnable risk response\n\n\n\nOption to enable the **Risk Response** tab on the risk assessment. This option appears only when **Risk** is selected from **Assess**.\n\n
\n\nResidual risk\n\n\n\nOption for assessing a residual risk.\n\n
\n\nTarget risk\n\n\n\nOption for assessing a target risk.\n\n
\n\nRollup Configurations\n\n
\n\nThis section appears only when **Risk** is selected from **Assess**.\n\n
\n\nCalculate ALE based on\n\n\n\nFormula that you can select for calculating the annual loss expectancy \\(ALE\\):- **Sum**\n- **Average**\n- **Maximum**\n- **Minimum**\n\n
\n\nCalculate score based on\n\n\n\nFormula that you can select for calculating the score:- **Average**\n- **Maximum**\n- **Minimum**\n- **Worst Case**\n\n**Note:** The worst case aggregation rollup selects the risk record with the highest residual score and uses its inherent, control, residual, and target scores for the aggregated result.\n\n\n
\n\nRisk Response Configurations\n\n
\n\nThis section appears only when **Risk** is selected from **Assess**.\n\n
\n\nEnable risk response task workflow\n\n\n\nOption to enable users to create, delete, remove, edit, and link risk response tasks within an assessment.\n\n
\n\nAllow single risk response\n\n\n\nOption to make the risk response selection a single select in the risk assessment form. For example, the options could be \"Accept,\" \"Avoid,\" \"Mitigate,\" or \"Transfer.\" With a single select, assessors can choose only one of these options to indicate the risk response strategy.**Note:** This option can only be enabled when there are no ongoing assessments.\n\n
\n\nAllow issue linking with risk assessment\n\n\n\nOption to create an issue or link an existing open issue with the risk assessment.\n\n
\n\nRisk response is required\n\n\n\nOption to make a risk response as required: - **None**: No risk response is required.\n- **Always**: Mandate a risk response always.\n- **On specific conditions**: Mandate a risk response based on specific conditions using the condition builder.\n- **On specific conditions defined using script**: Mandate a risk response under specific conditions using a predefined script or set of instructions.\n\n
\n\nBusiness Rules and Validations\n\n
\n\nFinal comment is required\n\n\n\nOption to make the final comments as required. Final comments provide better transparency and enable risk owners to communicate the action plan if there’s a breach of appetite or tolerance. The options are as follows: - **None**: No final comment is required.\n- **Always**: Mandate final comments always.\n- **On breach of appetite**: Mandate final comments on the breach of appetite.\n- **On breach of tolerance**: Mandate final comments on the breach of tolerance.\n\n This field appears only when **Risk** is selected from **Assess**.\n\n
\n\nAutomatically create issue\n\n\n\nOption to create issues automatically. This field appears only when **Risk** is selected from **Assess**. - **None**: Enables you not to create issues automatically.\n- **On breach of appetite**: Creates issues automatically on the breach of appetite.\n- **On breach of tolerance**: Creates issues automatically on the breach of tolerance.\n\n **Note:** The issues are created only after the risk assessment is approved and moved to the published state.\n\n
\n\nResidual score is lower than inherent\n\n\n\nOption to validate that the qualitative residual score is lower than the inherent score. **Note:** This option appears only when the residual risk assessment is enabled.\n\n
\n\nReference Information\n\n
\n\nThis section appears only when **Risk** is selected from **Assess**. Enabling these options shows the reference information in the risk assessment instance.\n\n
\n\nShow related risk events\n\n\n\nOption for showing the related risk events on the risk assessment.\n\n
\n\nShow related risk indicators\n\n\n\nOption for showing the related risk indicators on the risk assessment.\n\n
\n\nShow open issues\n\n\n\nOption for showing the open issues on the risk assessment.\n\n
\n\nShow previous assessment\n\n\n\nOption for showing the previous assessment on the risk assessment. This option helps the risk assessor to refer to the previous assessment and analyze the details of that assessment before taking another assessment.\n\n
\n\nOther Configurations\n\n
\n\nAdvanced reminder \\(days\\)\n\n\n\nBased on the due date of the risk assessment, this field is the number of days before a notification is sent to the assessor. For example, if you enter 3 in this field, then the assessor gets a reminder notification three days before the due date.\n\n
\n\nOverdue reminder \\(days\\)\n\n\n\nBased on the due date of the risk assessment, this field is the number of days after this date that reminder emails are sent. For example, assume you enter 5 in this field. Then for five days after the due date is over, the assessor keeps receiving reminder emails that the due date is over. On the sixth day, an email notification is sent to the assessor and to the assessor's manager.\n\n
\n\nRisk identification\n\n\n\nMethod to identify risks in the risk assessment scope:- **None**\n- **From Library**: Identifies risks from the library on the risk assessment.\n- **Ad-hoc**: Identifies a risk that is not in the library.\n- **From Library and Ad-hoc**: Creates risks as well as adds risks from the library.\n\n
\n\nGroup factor comments\n\n\n\nOption to enable group factor comments in the risk assessment form.\n\n
\n\nCopy previous responses\n\n\n\nOption to copy the factor responses and comments whenever a reassessment is performed.\n\n
\n\nAllow override of results\n\n\n\nOption to override the computed scores and the ALE during risk assessment.\n\n
\n\nConfigure section terminology\n\n\n\nOption to configure section labels for inherent, control, residual, and target assessments. After you select this option, you can configure the title, score label, and annual loss expectancy label for each assessment type.**Note:** Section label renaming applies only to the advanced risk assessment interface while leaving the terminology used in reports, dashboards, heatmaps, and other areas unchanged.\n\n
\n\nUpdate assessment results to source record\n\n\n\nOption to copy the assessment results to the source record on which the assessment is performed. You can define the assessment result mapping for the applicable record types in the individual assessment types. This field appears only when **Object** is selected from **Assess**.\n\n
\n\nSchedule\n\n
\n\nThis section appears only when **Object** is selected from **Assess**.\n\n
\n\nReassessment frequency\n\n\n\nOption of how often the reassessment is performed:- **None**\n- **Weekly**\n- **Monthly**\n- **Quarterly**\n- **Semi-annually**\n- **Annually**\n\n
\n\nDays to overdue\n\n\n\nBased on the due date of the risk assessment, this field is the number of days after which an assessment is considered overdue.\n\n
**Parent Topic:**[Configure a risk assessment methodology](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-risk-management-workspace/configure-ram.md)\n\n"}}