---
schema_version: "1"
id: 0bdf5edb46d2e578511e697c240d8c142638a0aefad80930854c76c5e28bf38a
title: Create a Risk Assessment for IT Compliance
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_create_risk_assessment.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_create_risk_assessment.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3ab922669a1fd9b0500ebc3bc2a084662679b56b4b9705c989545036409d480e
description: Send a structured survey to stakeholders so they can weigh in on a risk's likelihood and impact. The responses drive the evidence-based scoring your team needs to make confident treatment decisions.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Create a Risk Assessment for IT Compliance

Send a structured survey to stakeholders so they can weigh in on a risk's likelihood and impact. The responses drive the evidence-based scoring your team needs to make confident treatment decisions.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d105806e74">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d105806e74 ">To create and manage risk assessments:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d105806e74 ">Compliance Admin permission set OR IT Compliance Fulfiller permission set</td>

          </tr>
        </tbody>
      </table>

A risk assessment is the survey your team sends from within a risk evaluation to gather input from the people closest to the risk, like the control owner, asset owner, or business unit leader. The active scoring expression set uses the participants' responses as input to recalculate the evaluation's likelihood and impact. This in turn, feeds into the residual risk score and any treatment recommendation that follows.

Send assessments manually when you want a specific stakeholder's perspective. When Continuous Evaluation is turned on, the AI agent also sends assessments automatically, picking the most appropriate survey template and the relevant stakeholders for each evaluation it drafts.

1. From App Launcher, go to the IT Compliance app and select **Risks**. Open the risk record you want to assess, go to the **Assessment** tab and click **New**.
2. Fill in the assessment details:
    
    - Participant. The user or user group you're surveying. Choose stakeholders with direct knowledge of the risk, like the control owner, asset owner, or relevant business unit lead.
    - Survey Template. The survey to send. Pick the out-of-the-box template that best fits the evaluation type, or one your admin has customized.
    - Due Date. The date by which you need responses.
3. Save your changes.

The participants receive a survey invitation with a link to the assessment. As responses come in, they appear on the assessment record. After all responses come in or the due date for completion is reached, the active scoring expression set uses the responses to recalculate likelihood and impact on the parent evaluation, and updates the inherent risk score accordingly.