Security and risk · LessonBy Neelima, ServiceNow Architect · Published · ServiceNow · all levels
Risk Management
Register risks, assess them consistently, monitor indicators and connect risk to real operational data.
Quick answer
Register risks, assess them consistently, monitor indicators and connect risk to real operational data.
Key takeaways
- Agree impact and likelihood scales before registering risks
- Every mitigation needs a control or a dated task
- Indicators fed by platform data keep the register live
- Link risk to services for business level reporting
Risk register
Risk statements attach to entities and carry inherent and residual scores. Consistency comes from a defined scoring method rather than from individual judgement, so agree the impact and likelihood scales before you start.
Assessment and treatment
Assessments run on a schedule against risk owners. Treatment options are accept, mitigate, transfer or avoid, and each mitigation should link to controls or to concrete tasks with dates.
Indicators from the platform
The advantage of running risk inside ServiceNow is live data.
- Use risk indicators fed by platform data such as failed changes or open critical vulnerabilities
- Show trend, a static register is a document not a programme
- Link risks to services so executives see business impact
- Review scoring calibration annually, scales drift
Practice challenge
+0 XPStreak ×0
Question 1 of 2
Which treatment means putting controls in place?
Frequently asked questions
Inherent or residual score?
Record both. Inherent shows exposure without controls, residual shows what remains after them, and the gap justifies your control spend.
Who owns a risk?
A named business owner, not the risk team. The risk function facilitates, the business accepts.