Configuring risk factor questions and derived risk factors

You can create a set of risk factor questions that are specific to a company or operational categorization. When you create risk factor questions, include all the questions that your company needs answered to complete a change request. These questions typically involve time, cost, number of people involved, and so on. You do not have to create questions for all companies. If a company does not have a specific set of questions, the global questions (configured for the Global company) apply. Using the Risk Factors Configuration form (Change Risk Levels and Factors form), you can create, update, and delete the Change risk level and factor records. To access this form, login as an administrator or as a user with the Infrastructure Change Config permission.

The form is sub-divided into two sections. In the first section, referred to as the Questions section, you can create and manage your risk questions. These risk questions are displayed within the change request view. In the second section, referred to as the Derived Factors section, you can create and manage your Derived Risk Factors. Both, the Risk Questions and Derived Factors, are then used by the application to determine and set the overall Risk Level for a given change request.

You can configure any of the following derived risk factors:

• CI priority (highest priority of all CIs that are related to the change request)
• CI impact
• Performance rating of support group
• Performance rating of change manager
• Performance rating of change coordinator
• Performance rating of change implementer
• Performance rating of operational CTI
• Performance rating of the support group
• Change impact

• Change priority

The Change Management application comes with one out-of-the-box record for the - Global – Company. By default, this record is used when there are no other company-specific risk factors configuration records defined. The out-of-the-box risk questions and derived factors are provided as examples data and you should modify them as per your use case requirements.

To configure new risk factor questions

1. From the Application Administration console, click the Custom Configuration tab.
2. From the Application Settings list, choose Change Management > Risk Factors > Change Risk Selection, and then click Open.

   
   
   

3. On the Risk Factors Configuration form, select the Company.
   The Company field helps you to identify which company the Risk Questions and Derived Factors configuration applies to. The Change Management application comes with one out-of-the-box record configured for the - Global - company, which the application uses when no other specific company records are defined. You can have one to many risk factor configuration records per company as long as they vary based on the operational categories.
4. (Optional) Select the operational categorization.
   The configuration applies to both the company and the operational categorization. You can select up to three levels of categorization. These can be used to create more specific Risk Questions and Derived Factors configurations that are applicable for a given operational category. The application tries to match the operational categories defined on the change request against entries defined to select a matching Risk Questions and Derived Factors configuration record. The operational category data can be considered as additional mapping data like the mapping data as seen in the Assignment and Approval mapping forms.
   For example, to define risk factor questions for provisioning a virtual machine, you might select the following three categorizations:
   • Tier 1 — Request
   • Tier 2 — Virtual Machine
   • Tier 3 — Provision
5. To create a new risk factor, click Add.
   The Risk Factors Template form appears. Use this form to create a question, possible answers, display sequence, and weighted risks that are specific to your company policy as applicable to the selected operational categorization.

6. Under the Questions tab, click Add to create and manage as many risk questions as you need based on your use cases.

   Important

   Keep the number to single digits to streamline the change creation process for users.

   
   
   
   

7. Enter the values for the following fields:

   Field	Description
   Company	This field automatically defaults to the Company value for the overall risk factors configuration record.
   Status	This field automatically defaults to Enabled. Important: Only the Enabled question records will be displayed to the users.
   Risk Factor	Enter a question that will be displayed to the users. For example, Must this change be performed during business hours?
   Risk Weight	Assign the importance of the risk factor based on your use case. For this, select risk weights (percentage weight) that indicate how significant the risk is to the change request. These values are predetermined in the CHG:ChangeRiskRanges form. You must have the AR Administrator role or the Infrastructure Change Config permission to modify these values. There are five possible values: 20%, 40%, 60%, 80%, or 100%, (represents the highest importance) Important: The application uses the Risk Weight with the Risk Value to calculate the overall risk.
   Display Sequence	Select the sequence order to display your question in the Risk Assessment Questions dialog box. You can create as many questions as necessary. The number value in this field is used to order the questions presented to the users.
   Locale	Use this field when you want to create your own localized questions and answer choices. For English, leave the field blank. For the other supported locales, select the value from the menu attached to the field.
   Menu Label	Under Answer Choices, define the set of possible answers for the given risk factor or question, that is, create predefined answers that are suitable for your question. For example, Yes and No, Numerical range (for example, 0, less than 5, and so on), menu choices. Important: The number of answer choices cannot exceed five. Best practice: We recommend to keep the number to single digits.
   Risk Value	Select the risk value to assign to your answer that indicates how likely the risk is to occur. The risk value is used to calculate the overall risk value on the change record. The risk values range from one to five. The higher the number you select, the higher the risk is for your change. Ensure that you clearly understand the relative values of the answers, as they apply to the overall weight of the question itself. Important: If you create an incorrect sequence of labels and risk values, use Delete to remove the answer choices, and then re-enter them.
   Menu Sequence	Specify the order in which the answers to your question appear in the Risk Assessment Questions dialog box, and then click Add or Modify. The number value in this field is used to order the menu labels or answers presented to the user.

8. Click Save.
   The Risk Factors Template form closes, and your question appears in the Risk Factors Configuration form. You can continue to enter questions.

9. In the Questions Per Page field, enter the number of questions to display in the Risk Assessment Questions dialog box.
   The maximum number that you can set is 5. If you create 10 questions, the first 5 that you define in the sequence are displayed to users. After those questions are answered, the next set of questions appears.

To configure derived risk factors

1. Configure risk factor questions, as described above.

2. Click the Derived Factors tab, and then click Add to create and manage the derived factors.
   
   
   
   

3. Enter the values for the following fields:
   

   Field	Description
   Company	This field automatically defaults to the Company value for the overall risk factors configuration record.
   Risk Factor Type	Select from the following options: Risk Object—Derives the risk based on either Impact or Priority values from the change record or from the related CI with the highest priority. This rating is derived from the related CIs, and not from values specified on the change. Performance Indicator—Derives risk based on performance of a person with a given functional role (that is, change manager, change coordinator, or change implementer), a support group (that is, change manager group and change coordinator group), or a given operational categorization. The stored performance rating of specific entities is recorded. A performance indicator risk factor refers to ratings that are directly related to values specified on the change. Important: Out-of-the-box, the change implementer and the change implementer group are no longer maintained on the Change form itself as they are handled via tasks. So, the change implementer selection is no longer used. The performance is directly related to the performance value specified within the Performance Rating field on the change record. Out-of-the-box, the Performance Rating field (field ID 301313100) is a hidden field on the Change form and not in any view. If you want to use this Derived Risk Factor Type, we recommend that you display this field in to both, the Remedy IT Service Management and the Smart IT Change views. For more information, seeMultiExcerpt named adding_custom_fields was not found -- Please check the page name and MultiExcerpt name used in the MultiExcerpt-Include macro. The Performance Rating values are defined below: Performance Rating Value Level 1 Lowest (worst rating) 2 Low 3 Medium 4 High 5 Highest (best rating) Both, the Risk Object values for a given change record, and the performance rating for the specific entities (that is, the change manager, change coordinator, and their respective groups) are recorded and stored within the CHG:ChangeRiskDerivedFactors form (backend form used by the Change application). The Performance Rating data stored in this form is updated over time and represents the historical performance data. The value selected within the Risk Factor Type field (that is, Risk Object or Performance Indicator) drives the Field Name selection values below. By default, this field is set to a Performance Rating of 3, which is set from within the change rules. For more information, see Review and Authorize stage - Risk and impact analysis.
   Risk Weight	Select a risk weight that indicates how significant the risk is to the change request. These values are defined in the CHG:ChangeRiskRanges form. You must have the AR Administrator role or the Infrastructure Change Config permission to modify these values. There are five possible values: 20%, 40%, 60%, 80%, or 100%, (represents the highest importance).
   Form Name	This field automatically defaults to the CHG:Infrastructure Change value.
   Field Name	Select the field on the Infrastructure Change form from which the risk factor is derived. Depending on the risk factor type, select one of the following fields: If you select the Risk Factor Type value as Risk Object, then the Field Name values are: Change Impact Change Priority CI Impact CI Priority If you select the Risk Factor Type value as Performance Indicator, then the Field Name values are: Change Coordinator Change Implementer (no longer used) Change Manager Operational CTI (that is, Category) Support Group Name This information is calculated based on the historical performance of the changes that use these values.  For example, if you select Operational CTI, a historical record is kept separately for each CTI used. If the CTI was Request > Virtual Machine > Provision, a performance history would be stored for it for each of the closed changes that had an operational CTI of Request > Virtual Machine > Provision.
   Rating Field Name	This field is set when you select the value of the Risk Factor Type field as Performance Indicator and currently only has one value of Performance Rating.
   Status	This field automatically defaults to Enabled. Important: Only the Enabled records are used when calculating the risk.
   Description	This field defaults to a value based on the selected Risk Factor Type and Field Name values.

4. Click Save.

   If you are modifying an existing risk factor by adding questions or derived risk factors, clicking Save is optional.

Example of derived risk factor based on CI Impact and CI Priority values

If you relate a CI to a change request and change the value of the Impact or Priority fields on the CI form in Remedy Asset Management, the derived risk factor of the change request changes accordingly. The following is the relation between the values of the CI Impact and CI Priority with the risk value of the related change request:

Follow the steps given below to calculate the derived risk factor of a change request that is related to a CI:

1. Go to the CI form and create a CI by selecting the following values:
   • Impact field—1-Extensive/Widespread
   • Priority field—PRIORITY_5
   • Service Type field—Business Service
2. From the Risk Factor Configuration form, go to Derived Factors tab > Derived Risk Factor Template.
3. Select the following values:
   • Risk Factor Type—Risk Object
   • Risk Weight—100%
   • Field Name—CI Impact
4. Create a new change request and relate this created CI. 
5. Save the change request.
   The Risk Level value is automatically calculated as 5.

For information about the formula used for calculations, see Sample rating calculation.