With Governance, Risk, and Compliance (GRC) Advanced Risk Assessment, create an integrated risk platform. This integrated platform supports various kinds of risk assessment methodologies and enables customers to integrate risk assessment as a part of their overall decision-making process.

Before understanding Advanced Risk Assessment in detail, it is important to understand the five key principles of risk management:

• Risk identification: Find, describe, and recognize an uncertainty that might help or prevent an organization in achieving its objectives​.
• Risk analysis: Understand the cause and consequence of the risk if the risk materializes.
• Risk evaluation: Compare of the results of the risk analysis, with the established risk criteria, to determine if additional action is required.​
• Risk treatment: Define an action plan​ to address the risk.
• Risk monitoring: Track the risk posture of the organization and communicating it to relevant stakeholders.

Risk assessment consists of risk identification, risk analysis, and risk evaluation. Advanced risk assessment is performed based on factors or questions and their responses. It can be performed for an entity such as an organization. To be able to use advanced risk assessment, users must enable the Migrate to Advanced Risk Assessments property located under the Administration module.

Advanced risk assessment enables the users to do a detailed assessment of the risks where the inherent risks, mitigating controls, and residual risks are assessed. If a user does not have the complete GRC setup for entities, risk statements, controls, and so on, they can still assess the risks on any ServiceNow® record or object. An example of object assessment is assessing change management. During risk assessment, the following risks are assessed:

• Inherent risks: Inherent risk is the risk level without controls. For example, driving at a high speed on a highway is inherently more of a risk than driving at a moderate speed. The score of this inherent risk is derived by multiplying the impact of the risk and the likelihood of the risk.
• Control effectiveness: Controls can either mitigate the impact or the likelihood. Examples of controls can be that the highways have speed limit monitors, speed control mechanisms within the vehicle and so on. In case a risk materializes, the controls mitigate the impact. Controls can be preventive, detective, or corrective. Preventive controls are designed to prevent errors, inaccuracies, or fraud before they occur. Detective controls are intended to discover the existence of errors, inaccuracies, or fraud that has already occurred. Corrective controls are designed to correct errors or irregularities that have been detected.
• Residual risks: Residual risk is the leftover risk after the implementation of controls. For example, despite the safety measures in place, if there’s still an accident, then the damage caused by the accident is a residual risk.