Configuring Formulas using the Formula Attribute

Field

Description

Name

Enter a name of the attribute.

Description

Enter a brief description of the attribute.

Response Type

Select Formula to allow users to build a formula to calculate risks.

Link Category

Enable this setting to select the risk categories that you would like to link to the attribute.

Note:

This setting is only available for risk attributes.

Formula

Build the formula using functions and existing risk attributes. For more information, see Use Case.

Tip:

You can use multiple attributes in the mathematical formula. To add multiple attributes to your formula, separate the attribute values with commas and place the attribute values inside the parenthesis of the formula.

The standard characters needed for mathematical functions include:

• Addition: +

• Division: /

• Modulo: %

• Multiplication: *

• Subtraction: -

/, %, and * have the same precedence and are evaluated from left to right.

+ and - have lower precedence than the above operators.

Function

Select from the default functions provided to build the formula. Some of the most common functions used are:

Function	Description	Syntax & Formula
SUM	Adds up a range of values. This is used to calculate a single summarized value from a set of related records and return it to a parent object.	Syntax: SUM (value 1, value 2, ...) Formula Example: = SUM (Assets: Aggregate Residual Score, Assets: Aggregate Inherent Score) This formula will sum all aggregate residual and inherent scores for an asset.
AVG	Calculates the average of a set of values. This is used to calculate a single summarized value from a set of related records and return it to a parent object.	Syntax: AVG (value 1, value 2, ...) Formula Example: Residual Risk Score = Inherent Risk Score - AVG (Control Effectiveness) This formula will return the average of all Control Effectiveness values linked to that risk, returning a single value that can be used in the formula. This ensure that the Residual Risk Score dynamically reflects the overall effectiveness of all mapped controls.
MAX	Returns the largest number in a set of values. This is used to calculate a single summarized value from a set of related records and return it to a parent object.	Syntax: MAX (value 1, value 2, ...) Formula: = MAX (Control Effectiveness) This formula will return the largest value from the control effectiveness value.
MIN	Returns the smallest number in a set of values. This is used to calculate a single summarized value from a set of related records and return it to a parent object.	Syntax: MIN (value 1, value 2, ...) Formula: = MIN (Inherent Risk Score, Residual Risk Score, Target Risk Score) This formula will return the smallest value from the risk scores.
LOG	The logarithm of a number is the exponent by which another fixed value, the base, must be raised to produce that number. This is used to calculate a single summarized value from a set of related records and return it to a parent object. Note: Singular Values: Can be a numeric attribute or combined with an aggregate function.	Syntax: LOG (number, [base]) Formula: = LOG (Assets: Aggregate Residual Score) or = LOG (SUM (Risk: Residual Score))
LN	The natural logarithm of x is the power to which e would have to be raised to equal x. This is used to calculate a single summarized value from a set of related records and return it to a parent object. Note: Singular Values: Can be a numeric attribute or combined with an aggregate function.	Syntax: LN(number)
SQRT	A mathematical function where the input (x) is placed inside a square root symbol (√). The output is the number that, when multiplied by itself, equals the input. In its simplest form, it's represented as f(x) = √x. This is used to calculate a single summarized value from a set of related records and return it to a parent object. Note: Singular Values: Can be a numeric attribute or combined with an aggregate function.	Syntax: SQRT(number)
EXP	The unique real function which maps zero to one and has a derivative equal to its value. This is used to calculate a single summarized value from a set of related records and return it to a parent object.	Syntax: EXP(number)
IF	Returns a value based on whether a condition is true or false.	Nested Syntax: =IF(condition1, result1,IF(condition2, result2,IF(condition3, result3,IF(condition4, result4,IF(condition5, result5,IF(condition6, result6,IF(condition7, result7,IF(condition8, result8,IF(condition9, result9,IF(condition10, result10,default_result)))))))))) Single Syntax: =IF (condition, value_if_true, value_if_false) Formula: = IF (AVG (Control Effectiveness) > 3, 4, IF(AVG(Control Effectivess) >, 8, 14))
AND	Returns true if all configurations evaluate to true and returns false if one or more configurations evaluate to false. It combines multiple conditions that all need to be true.	Syntax: AND(logical1) Formula: IF (Risk: Residual Score > Risk: Inherent Score AND (Risk: Residual Score > Risk: Target Score), {Then EXPRESSION}, {Else EXPRESSION})
OR	Returns true if any of its configurations evaluate to true and returns false if all of its configurations evaluate to false. It combines multiple conditions where at least one needs to be true.	Syntax: OR(logical1, [logical2], …) Formula: = SUM (Children Risk < 5 OR (Residual Risk Rollup Score > 20)) This formula will return the sum of children risk over 5 or residual risk rollup scores lower than 20.
COUNT	An aggregator function used primarily to count the number of related records linked to a parent object. Returns the number of entries that are a number value.	Syntax: COUNT(value1, [value2], …) Formula #1: = COUNT(Issue Status = 1) This formula will return count of open issues. This is useful for reporting, dashboards, and risk scoring where you only want to count items in a certain state (e.g., open, overdue, or unresolved). Formula #2: = IF(COUNT(Issue Status = 1) > 2, 4, 1) This formula will return 4 if the total open issues are > 2 or else it will return 1.
IN	This can be used in a formula to say "Contains Any". Note: This function is only available for multi select attributes.	Syntax: IN (value1, value2, ...) Formula: Category IN (Confidentiality, Integrity) This formula states that the category must be Confidentiality OR Integrity.
NOT IN	This can be used in a formula to say "Does Not Contain". Note: This function is only available for multi select attributes.	Syntax: NOT IN (value1, value2, ...) Formula: = Category NOT IN (Confidentiality, Availability) This formula states that the category is not in confidentiality or availability.

You can also use the logical operators below when building the formula:

• = (Equals)

• < > (Not Equals To)

• > (Greater Than)

• < (Less Than)

• >= (Greater Than or Equal to)

• <= (Less Than or Equal to)

Risk Attributes

Select from custom and system risk attributes in the list provided to build the formula.

You can also include single select and multi select attribute options when creating formulas to help increase the accuracy of risk score calculations by having a comprehensive set of data. The attribute options shown will be based on the attribute selected in the formula.

Note:

Single select and multi select attribute options can only be used on the right side of the formula expression.

You can use the Search field to easily filter and locate attributes and attribute options. To view attribute options, click the attribute name. To navigate back to the full list of attributes, click on the down arrow next to the attribute name.

Rescore Existing Risks

Enable this setting to rescore existing risks with the new formula. Disable this setting to only calculate future risks.

This section includes common formula building use cases that may be helpful when configuring formula attributes.

Use Case #1: Using the IF Function to Build Formulas

You can configure formula type attributes for risks, controls, and inventories using the IF function. This allows you to create conditional formulas to calculate risk scores based on defined criteria.

This formula is created on the Inherent Risk Score attribute. In this case, if the Impact = 1 (Low) and likelihood = 1, set the Inherent Risk to *1, IF the Impact = 2 (Medium), set the Inherent Risk to *2, ELSE i.e. if none of these conditions are met set the Inherent Risk to *2.5.

Important:

The IF function only supports numerical values. It does not support alpha numerical items.

Additional IF Function Examples:

Use Case #2: Using the IF Function to Build Formulas

Use Case #5: Single Select & Multi Select Attribute Option Support

Risk managers and system admins can seed conditional formulas using attribute options. Simplifying the process of creating formulas and allowing for the setting of attribute values based on specific conditions can reduce the time spent on formula creation, and increase the accuracy of risk score calculations. Attribute options can be configured in the formula when creating a new formula attribute or updating an existing attribute.

In this formula, the risk weightage is populated based on risk category. In this case, the risk weightage is a custom attribute. Category = Privacy, Risk Weightage = 150% Category = Security, Risk Weightage = 200 or else Risk Weightage = 100

This section includes common formula building insights and best practices that may be helpful when configuring formula attributes.

• Expressions can be an IF expression or a value expression. Conditional Expressions use logical comparators to get a true/false output, which determines the then/else expression. The left and right sides of the expression should be singular values. For example:

  • IF (CONDITIONAL EXPRESSION, THEN EXPRESSION)

  • IF (CONDITIONAL EXPRESSION, THEN EXPRESSION, ELSE EXPRESSION)

• Things to know about the SUM, AVG, MAX, and MIN functions:

  Singular Values

  SUM (Assets: Aggregate Residual Score, Assets: Aggregate Inherent Score)

  Related Object Attribute

  SUM (Risk: Residual Score) (aggregates all risks associated with a particular asset)