ServiceNow CIS-RC Practice Questions

Answer: A

Why this is correct
The Risk Hierarchy section says risk managers and administrators create and view hierarchies on the risk statement form: they define a parent risk statement using the Parent field and add children risk statements using the Risk Statements related list. Starting with New York, such hierarchies can include different types of risk, such as operational risk, IT risk, or strategic risk. Once the underlying risks are assessed, the risk scores are automatically rolled up across the risk statement hierarchy, providing better tactical and strategic decision-making.

Why the other options are wrong
"Create child risk frameworks beneath one parent risk framework record" … A risk framework is a collection of risk statements, stored in Risk Framework [sn_risk_framework]. The page builds the hierarchy from risk statements through the Parent field and the Risk Statements related list.
"Have a risk user add children in the Risk Statements related list" … The note on the page says risk users can view the hierarchies established by the managers and administrators. Creating the hierarchy is the work of risk managers and administrators.
"Link upstream and downstream risks to each other in Risk Relationship" … Risk Relationship [sn_risk_m2m_risk_risk] contains the upstream-downstream or parent-child relationship between two risks. It links individual risks, while the hierarchy on this page is built from risk statements.

Key point
Different people in the organization own and manage their own risks, but top-level risk scores take into account the score of all the risks below. Managing all the different risk areas in a central location provides an integrated view of the total risk posture. Entities, entity types, and indicator templates can be associated at any level of the risk statement hierarchy.