---
schema_version: "1"
id: 954530283928721748794c2219cad132108c9f06ba96703bb244fb9db1c37812
title: Create a Risk Evaluation for IT Compliance
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_create_risk_evaluation.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_create_risk_evaluation.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f972aa14b9a71829c699d4098724b88be2d9f5a6b38106f7f7338a01f600c625
description: Assess the severity of a registered risk by creating a risk evaluation. Gather structured feedback from stakeholders on a threat's potential impact and likelihood to automatically calculate your inherent and residual risk scores.
products:
- Service Cloud
- Agentforce IT Service
release: "264"
---
# Create a Risk Evaluation for IT Compliance
Assess the severity of a registered risk by creating a risk evaluation. Gather structured feedback from stakeholders on a threat's potential impact and likelihood to automatically calculate your inherent and residual risk scores.
### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service.
User Permissions Needed
To create risk evaluations:
Compliance Admin permission set
A risk evaluation anchors a structured review of a single risk. It captures who's responsible for the review, when input is needed, and the impact and likelihood scores once stakeholders weigh in. The active scoring expression set uses those scores to calculate the inherent risk score, and recalculates the residual score as you map mitigating controls to the risk.
Create evaluations manually for initial baseline reviews, periodic re-assessments, or ad-hoc reviews triggered by a business event. When Continuous Evaluation is turned on, the background agent also creates evaluations autonomously when it detects changes to mapped policy clauses, controls, or scopes.
1. From App Launcher, go to the IT Compliance app and select **Risks**. Open the risk record you want to evaluate and go to the **Evaluations** tab.
2. Click **New** and fill in the evaluation details:
- Name. Like Q1 Initial Posture Analysis or Q2 Re-Assessment after Policy Update.
- Subject to describe what's being evaluated and why, especially if the evaluation was triggered by a specific event.
- For Assigned To, select the user responsible for running the evaluation, usually the risk owner or a security lead.
- For Due Date, select the date by which the assessment must be completed.
- Select a Status. New evaluations typically start in In Progress.
3. Save your changes.
The evaluation appears on the Evaluations tab of the risk record. From here, your team sends Risk Assessment surveys to gather impact and likelihood input from stakeholders. Once those scores are entered, the active scoring expression set calculates the inherent risk score on the evaluation, and the residual score updates as mitigating controls get mapped to the risk.
Example: Q1 evaluation for the North America Sales phishing risk
Suppose your compliance team has just registered a Phishing Attack risk for the North America Sales business unit and wants to establish a baseline posture. They kick off the first evaluation:
- Name: Q1 Initial Posture Analysis — Phishing NA Sales
- Subject: First evaluation of phishing posture for the North America Sales tenant.
- Assigned To: Jordan Kim, CISO for North America
- Due Date: Mar 31, 2026
- Status: In Progress
After save, the evaluation appears under the Evaluations tab on the risk record. Your team then sends Risk Assessment surveys to relevant stakeholders to gather Likelihood and Impact input. Once those scores come in, the active scoring expression set calculates the inherent risk score on the evaluation.