---
schema_version: "1"
id: 33f617a74173d5a45c119dd0f72a1fe7f65b8ca38bcd8c8187e8cfe77758e1d1
title: Manage Risks for IT Compliance
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_setup_work_with_risk_mgmt.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_setup_work_with_risk_mgmt.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0f27274b2afd43e8481cfec4d32c39c21b8c4cca841789ceffec9e9e8b8b13c8
description: Move risks through their full lifecycle in one place, from spotting a new threat to closing the loop. Capture risks from a curated scenario library, score them automatically with the Business Rules Engine, link the controls and policies that mitigate them, and assign treatment plans your team can act on.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Manage Risks for IT Compliance

Move risks through their full lifecycle in one place, from spotting a new threat to closing the loop. Capture risks from a curated scenario library, score them automatically with the Business Rules Engine, link the controls and policies that mitigate them, and assign treatment plans your team can act on.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service.</td></tr></tbody></table>

- **[Risk Management Workflow for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_risk_mgmt_workflow.htm&release=264.0.0&type=5)**  
    Follow how a compliance team identifies, evaluates, and mitigates compliance risks that threaten regulations and policies. See how risks are linked to controls that reduce risk severity, and how risk scores update dynamically as controls pass or fail tests.
- **[How Risk Scores Are Calculated for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_risk_scoring.htm&release=264.0.0&type=5)**  
    Agentforce IT Service calculates two scores for every risk—an inherent score that reflects raw severity before any safeguards, and a residual score that shows what remains after mapped controls are factored in. Both scores are calculated automatically by the Business Rules Engine using the active risk scoring expression set.
- **[Continuous Risk Monitoring for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_cont_risk_monitor.htm&release=264.0.0&type=5)**  
    Background agents continuously watch your IT environment and your controls, flagging new risks and re-running evaluations the moment something changes, so your team always works from a current view of the risk landscape.
- **[AI-Based Summaries for Risk Records in IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_ai_risk_summaries.htm&release=264.0.0&type=5)**  
    Agentforce summarizes risk data, evaluations, and treatment history into a concise narrative for compliance leaders. This helps your team analyze potential impacts and understand current mitigation strategies without opening every related record. By providing clear rationales and suggested next steps, these summaries simplify stakeholder communication and help you decide treatment plans.
- **[Work with Risks for IT Compliance](https://help.salesforce.com/s/articleView?id=service.it_srvcs_setup_work_with_risks.htm&release=264.0.0&type=5)**  
    Capture, score, and treat the risks facing your IT environment. Build a reusable scenario library so your team logs threats consistently, gather evaluations from the stakeholders who know each risk best, map risks to the controls and policies that protect against them, and assign the treatment plans that drive each one to closure.