Configuring a Risk Score Formula

Note:

Configuring the risk score formula is part of the risk scoring upgrade. Beginning in the OneTrust 202307.1.0 release, qualified customer accounts can request the risk score upgrade. See Risk Scoring Upgrade Guide for qualified account requirements.

The risk scoring upgrades are currently under preview. If your organization would like to enable access to any of the preview features listed below, please contact OneTrust Support to submit the request.

You can edit the level color, score ranges, and levels in the Attribute Manager. Any configurations you create here will be consistent across all of your owned modules. For example, you cannot have a different formula for IT & Security Risk Management and Third-Party Risk Management.

For more information on risk scoring, see Risk Scoring Upgrade Guide.

To change the attribute to a formula score type

The following score type attributes can be used to configure a formula on the Formula tab.

  • Inherent Risk Score

  • Residual Risk Score

  • Target Risk Score

The attribute must be changed to a formula score type using the steps below before you can configure the risk score formula.

  1. On the IT & Security Risk Management menu, select Setup > Attribute Manager.

    The Attribute Manager screen appears.

  2. Click the View button on the Risk Attributes tile.
    The Attribute Manager screen appears.

  3. Open a score type attribute.
    The Attribute Details screen appears.
    Note:

    The score type attributes you can open are Inherent Risk Score, Residual Risk Score, and Target Risk Score.

  4. Click the Edit Details button.

    The Edit Attribute Details modal appears.

  5. Complete the fields. For more information, see Edit Attribute Details Modal Reference.
  6. Click the Save button.

Edit Attribute Details Modal Reference



Field
Description
Score Type

Select Formula.

Rescore Existing Risks

Enable this setting to rescore existing risks with the new formula.

Note:

If this setting is disabled, only net new risks will be calculated.

The risk rescore will impact all risk fields. This action is irreversible.

Edit Formula

Click the Edit button to edit and run a test validation for your formula. For more information, see the Edit Formula and Levels Modal Reference section in the Configuring Standard and Formula Score Attributes article.

To edit the formula in Attribute Details

Note:

The risk rescore will impact all risk fields. This action is irreversible.

Changing this formula score type to a matrix score type will remove all of your previous configurations.

  1. On the IT & Security Risk Management menu, select Setup > Attribute Manager.

    The Attribute Manager screen appears.

  2. Click the View button on the Risk Attributes tile.

    The Attribute Manager screen appears.

  3. Open the attribute you assigned as a formula score type.

    The Attribute Details screen appears.

  4. Select the Formula tab.
  5. Click the Edit Formula button.
    Note:

    You can click the Edit Details button to open the Edit Attribute Details modal and change the score type.

  6. Edit your risk score formula. For more information, see the Edit Formula and Levels Modal Reference section in the Configuring Standard and Formula Score Attributes article.


    Note:

    You can configure the aggregation method for inventories in Global Settings > Risk Scoring. This determines how individual risk points form a comprehensive risk score. The score level ranges can be configured in the Attribute Manager.

  7. Click the Save button.
    The Rescore modal appears.

  8. Click the Rescore & Save button to rescore existing risks and related objects with this new formula/ level configuration.

    Click the Don't Rescore & Save button to not rescore. In this case, only net new risks will be scored using this new formula / level.