risk-identification

Risk Identification

Overview

This skill supports proactive risk identification in ServiceNow® before full assessment and treatment. It helps teams:

Gather risk signals from business applications, issues, and operational events
Classify and prioritize risk candidates
Route high-priority candidates for formal assessment
Maintain governance-ready evidence for risk intake decisions

Use this when risk managers need structured early detection, not only post-event summarization.

Prerequisites

Roles: sn_grc.manager, sn_risk.manager, or admin
Plugins: GRC / Risk Management enabled
Access: Read/write access to risk identification, profile, risk, and issue tables
Policy Inputs: Risk taxonomy, scoring thresholds, and escalation criteria

Procedure

Step 1: Confirm Risk Identification Schema

Validate table and fields used in your instance for risk identification workflows.

Using MCP:

Tool: SN-Discover-Table-Schema
Parameters:
  table_name: sn_risk_identification

If your instance uses alternate table names, capture mappings before continuing.

Step 2: Ingest Risk Candidate Signals

Pull new or updated risk candidates and supporting context.

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: sn_risk_identification
  query: stateINnew,under_review^sys_updated_on>=javascript:gs.daysAgoStart(7)
  fields: number,short_description,state,category,profile,owner,likelihood,impact,sys_updated_on
  limit: 100

Step 3: Enrich with Profile and Historical Context

Gather profile posture and related historical risk records.

Using MCP:

Tool: SN-Query-Table
Parameters:
  table_name: sn_grc_risk
  query: profile=[profile_sys_id]^active=true
  fields: number,short_description,state,residual_risk,inherent_risk,risk_score
  limit: 50

Step 4: Score and Prioritize Candidates

Apply an intake score based on impact, likelihood, velocity, and control coverage.

Suggested decision bands:

High: escalate immediately to formal assessment
Medium: assign analyst review with due date
Low: monitor and capture rationale

Step 5: Create Follow-Up Actions

Route high/medium items into accountable next steps.

Using MCP:

Tool: SN-Create-Record
Parameters:
  table_name: task
  fields:
    short_description: "Risk identification follow-up"
    description: "Perform formal assessment for high-priority risk candidate."
    priority: 2

Step 6: Record Governance Evidence

Write final intake rationale with scoring factors and escalation decision.

Tool Usage

Tool	Purpose
`SN-Discover-Table-Schema`	Validate table names and field availability
`SN-Query-Table`	Retrieve candidate, profile, and historical risk data
`SN-Get-Record`	Inspect individual candidate details
`SN-Create-Record`	Create follow-up tasks/issues for escalated candidates
`SN-Update-Record`	Update candidate state and priority
`SN-Add-Work-Notes`	Capture audit-ready intake rationale

Best Practices

Separate risk identification from risk treatment decisions
Keep scoring model transparent and versioned
Use consistent category mapping to avoid duplicate risk records
Time-box analyst review for medium-priority candidates
Link every escalation to an owner and target completion date

Troubleshooting