Risk Scoring Upgrade Guide

Overview

The risk score upgrade allows you to customize the risk matrix and formulas in the Attribute Manager. This upgrade allows you to dynamically upgrade your risk scoring matrix and configure a Sum, Multiplication, or Custom risk scoring formula to calculate your risk score. The upgrade also allows you to configure custom mathematical formulas on formula score attributes to perform risk calculations and change risk scoring.





Note:

You can continue to setup risk scoring for inventories using the aggregation methodology in Global Settings > Risk Scoring. For more information, see Setting Up Risk Scoring.

What is the value of the risk scoring upgrade?

The risk scoring upgrade caters to mature OneTrust customers and offers a variety of helpful features, including the ability to complete the following actions:

  • Configure risk scoring in the Attribute Manager

  • Change the matrix color by configuring the level color

  • Edit the score ranges

  • Utilize more than one scoring formula by having a separate calculation for inherent, target, and residual risks

    Note:

    Inherent is the initial risk level when created. Residual is the same as inherent, but can change over time, and the target is the ideal risk level.

  • Configure a custom formula to perform risk calculations and change risk scoring

  • Calculate residual risks automatically based on controls

  • Add or remove levels

  • Support risk level conditions in workflows

  • Update risk levels via bulk import templates

Risk Scoring Upgrade Timeline

Upgrade Release / Date Range

Customer Type

OneTrust 202411.2.0 Release

The new risk scoring will be automatically available for all net new tenants.

All customers using standard scoring type and with a risk count of zero will also be upgraded.

OneTrust 202502.1.0 Release

All customers using standard scoring type and with more than one risk accounted for will be upgraded.

OneTrust 202503.1.0 Release

All customers using sum-based matrix scoring type will be upgraded.

OneTrust 202503.2.0 Release

All customers using multiplication-based matrix scoring type will be upgraded.

OneTrust 202510.1.0 Release

September 20, 2025 - December 7, 2025

Production environments will be upgraded after the 202510.1.0 release is complete. Upgrades will be rolled out over three weekends, aligned with the release schedule. 

October 11-12 Targeted Environments:

  • vendorpedia

  • trial

  • app-in

  • app-au

  • cookiepro

  • app-jp

  • demo-prod

October 18-19 Targeted Environments:

  • app-ca

  • app-apac

  • app-de

  • app-br

  • app-uk

  • app-hc

  • app-eu

  • app-ch

  • app-prod

  • app-ae

December 6-7 Targeted Environments:

  • app-fr

Note:

Between September 20 and November 3, all remaining customers will be upgraded. This includes: customers using the count of risk scoring methodology, customers using custom risk methodology, and those who requested additional time prior to upgrading.

Old Risk Scoring vs New Risk Scoring

The table below provides the differences between the old and new risk scoring.

Feature

Old Risk Scoring

New Risk Scoring

Location

Where is the risk scoring configuration located?

Global Settings

Attribute Manager

Note:

Formulas and custom scores will be configured in the Attribute Manager. Assessment risks are still managed in Global Settings.

Scoring Methodology

What scoring methodology can be used to calculate risk scores?

  • Standard: One-dimensional, because it only includes impact not probability.

  • Matrix: No validation because levels can be changed at any time. No retroactive upgrades - any risks scored previously must be manually updated.

Formula: The formula used is (sum / multiplication of impact, probability, and impact).

Note:

The formula scoring method is part of the new risk scoring upgrade. Existing risks must be updated because there was no impact/probability concept.

Standard: One-dimensional, because it only includes impact not probability.

Matrix: No validation because levels can be changed at any time. No retroactive upgrades - any risks scored previously must be manually updated.

Risk Levels

What additional risk levels can be added?

You can add impact / probability levels, but could not add new risk levels. Only four levels exist - Low, Medium, High, Very High.

You can add additional impact / probability levels. New risk scoring uses inherent, residual, and target risk levels that all utilize the same metrics and range settings.

Workflow Conditions

Does the risk scoring methodology support risk level conditions in workflows?

No

Yes

Support for Count of Risk Methodology

Yes

Yes

Assessment Templates

Does the risk scoring methodology support assessment template rules for pre-seeded risks?

Yes. There is no retroactive update to the assessment template rules.

No. The new risk scoring will not retroactively update previous risk scores.

Residual Risk Attributes

What changes were applied to existing attributes?

The Residual Risk Level and Residual Risk Score attributes are listed on the Assessments, Risk Register, inventory screens.

The Residual Risk Level attribute has been merged with the Residual Risk Score attribute because inventory aggregated attributes are converted to score type.

Things to Know

The list below defines current gaps and important things to know regarding the new risk scoring upgrade.

  • Risks are not upgraded retroactively with the new risk scoring. All risks created before the new risk scoring upgrade will need to be updated manually. You have the option to edit the formula/matrix details and rescore existing risks.

  • Upgraded tenants must activate the Aggregate Risk Score attribute within the Attribute Manager of the inventories to see the aggregate score within the Risks tab score card.

  • Upgraded tenants can still configure the aggregation method for an inventory in Global Settings. This determines how individual risk points form a comprehensive risk score. The score level ranges can be configured in the Attribute Manager.

  • When risks are triggered from template rules, it will take in the impact/probability values and the risk score will be based on the current settings. This may be different from what is being shown in the template rules.

  • The assessment risks are still managed in Global Settings.

  • When creating risks in the Risk Register, the risk score and risk level that appear are based on the score type configured for attributes in the Attribute Manager. This includes custom score type attributes. Use the following list to determine when certain fields display:

    Standard Score Type

    - When this score type is selected, the risk score, risk impact level, and risk probability level fields will appear for the given attribute.

    Formula Score Type

    - When this score type is selected, the risk score field will not appear for the given attribute.

    Matrix Score Type

    - When this score type is selected, only the risk score field is displayed for the given attribute.

    For more information, see Managing Risks in the Risk Register.

Risk Scoring Demo

This demo will walk through the overall use case and an end-to-end example of how to complete the risk scoring process. Regardless of method type, scores will be auto-calculated under the new risk scoring.

Comprehensive Risk Scoring Walkthrough

Quick Guide to New Risk Scoring

Frequently Asked Questions

Will my current risk scoring methodology be altered by the upgrade?

No. Your risk scoring methodology will not change. However, immediately after the upgrade, the location of where you configure your risk scoring methodology will be altered. Risk scores can no longer be randomly customized and any previous customization will be removed. Utilize the table below to view the impacts the upgrade will have on your current scoring methodology. Regardless of method type, scores will be auto-calculated under the new risk scoring.

Current

Post Migration

Standard

Score Standard

Default Matrix

Score Matrix Sum

Custom Matrix

  • Customized matrix where the X and Y axis are SUMs or PRODUCTs.

Score Matrix Sum, Score Matrix Multiplication, and custom Score Matrix

Custom Matrix

  • OneTrust cannot determine your current risk scoring pattern. For example:

OneTrust will give you the option to upgrade to one of the following options:

  • Score Standard

  • Score Matrix Sum

  • Score Matrix Multiplication

  • Score Custom Matrix

Note:

You will have the ability to update your scoring method post upgrade.

Why is the risk scoring option no longer with Risk Settings?

With the new risk scoring upgrade, the risk and inventory risk scoring are now in the Attribute Manager to make it easier to manage attributes. The assessment risks are still managed in Global Settings. The inventory manager also contains options to configure risk scoring aggregation for inventory-based attributes.

How do new accounts get the risk scoring upgrade?

New accounts do not get the new risk scoring by default. Net new accounts will have new risk scoring available in an upcoming release.

What should I do if I do not want to be upgraded to the new risk scoring?

Eventually, all customers will be upgraded to the new risk scoring process. If you would like more time before the upgrade, you can opt out of the automated migration. To opt out, complete the Microsoft Form included in the risk upgrade announcement email or the opt-out reminder email. These email notifications will be sent out in batches based on when your account will be impacted.

To continue receiving support and updates, the update is required. If you decide to not upgrade to the new risk scoring, please note the following:

  • No support will be provided for bugs reported after the upgrade deadline.

  • Ongoing support and assistance are only available to customers who have upgraded.

  • No enhancements or improvements will be made to the current version of this feature.

Will my assessment template rules be updated in the upgrade?

No. Your template rules will not get updated in assessments after the upgrade. The new risk scoring upgrade only applies to new risks. Existing risks will not be updated unless you manually go in and change it.

This is because previously existing templates in your OneTrust tenant use the standard methodology and because assessments operate differently from individual risk scoring.

Will my assessment aggregation reflect the new risk matrix?

No. Changes to assessment methodology does not pick up individual risk methodology and will remain in Global Settings. There may be differences in the aggregation score of an assessment vs individual risks for the new and old risk scoring.

As of the OneTrust 202508.1.0 Release, the assessment aggregation methodology for custom matrix and risk count is now supported for score-migrated tenants. The aggregation logic evaluates Target, Inherent, and Residual risk scores independently to accurately reflect risk levels based on the total number of risks per level and to ensure consistency across your assessment data. The custom matrix is now supported for score type attributes in addition to sum and multiplication.

Is the count of risk supported for inventory aggregation in Global Settings?

The COUNT of risk is not supported for inventory aggregation in Global Settings. To set up the COUNT of risks, the user must go to the Attribute manager, open inventory attributes, and update the aggregate risk score formula attribute to include the COUNT of risk use case. Here is an example formula for COUNT of risks:



In the formula above, the following are true:

  • If the count of Residual Risk Score = Very High is greater than zero, then the aggregated score is 4 and the level is Very High.

  • If the count of Residual Risk Score = High is greater than zero, then the aggregated score is 3 and the level is High.

  • If the count of Residual Risk Score = Medium is greater than zero, then the aggregated score is 2 and the level is Medium.

  • If the count of Residual Risk Score = Low is greater than zero, then the aggregated score is 1 and the level is Low.

  • If none of the above conditions are satisfied, then the aggregated score and level are set to NULL.

When a new risk is created via template rules, will it follow the new or old risk scoring?

All template rules created prior to the risk scoring upgrade will not be updated. Any new changes and rules added after the risk scoring upgrade will reflect the new risk scoring changes. Current risk will not be updated unless you manually go in and make changes.

If I bulk update existing risks, will it reflect the new risk scoring?

Yes. Bulk updating existing risks after the upgrade will reflect new risk scoring.