Risk Management
Quick answer
Register risks, assess them consistently, monitor indicators and connect risk to real operational data.
Key takeaways
- Agree impact and likelihood scales before registering risks
- Every mitigation needs a control or a dated task
- Indicators fed by platform data keep the register live
- Link risk to services for business level reporting
Risk register
Risk statements attach to entities and carry inherent and residual scores. Consistency comes from a defined scoring method rather than from individual judgement, so agree the impact and likelihood scales before you start.
Assessment and treatment
Assessments run on a schedule against risk owners. Treatment options are accept, mitigate, transfer or avoid, and each mitigation should link to controls or to concrete tasks with dates.
Indicators from the platform
The advantage of running risk inside ServiceNow is live data.
- Use risk indicators fed by platform data such as failed changes or open critical vulnerabilities
- Show trend, a static register is a document not a programme
- Link risks to services so executives see business impact
- Review scoring calibration annually, scales drift
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
Which treatment means putting controls in place?
- A. Accept
- B. Mitigate
- C. Transfer
- D. Avoid
Show answer
B. Mitigate
Mitigation reduces likelihood or impact through controls.
What keeps a risk register current?
- A. Annual workshops only
- B. Indicators fed by platform data
- C. More risk statements
- D. Longer descriptions
Show answer
B. Indicators fed by platform data
Live indicators surface change between review cycles.