The Risk Scoring values are entered on the Risk Statement. What records inherits the values from the Risk Statement?

In the ServiceNow Risk Management data model, a Risk Statement (snriskdefinition) serves as a reusable template that defines a potential risk. When a specific instance of that risk is identified for a particular scope (e.g., for a business process or asset), a Risk record (snriskrisk) is created. This Risk record, historically referred to as a Registered Risk, inherits its default attributes, including scoring values like impact and likelihood, directly from the parent Risk Statement.

A. Risk Criteria Matrix: This is not a standard ServiceNow GRC table or record type that inherits values from a Risk Statement.
B. Risk Framework: A Risk Framework is a container for Risk Statements. It sits higher in the data hierarchy and does not inherit values from them.
D. Risk Response Issue: An Issue is a task created to address a finding related to a risk or control; it does not inherit the risk's scoring values.

- ServiceNow Product Documentation. (2023). Risk management in GRC. [Online]. Available at: docs.servicenow.com. The section on the Risk Management process describes the relationship between Risk Frameworks, Risk Statements, and Risks.

- ServiceNow Product Documentation. (2023). Create a risk from a risk statement. [Online]. Available at: docs.servicenow.com. This page explicitly states that when a risk is created from a statement, "the fields are automatically populated with the values from the risk statement."