Which statement is true of a Risk Response task?

Which statement is true of a Risk Response task?

• A. Only one Risk Response task can be related to a Risk at a time
• B. Only users with the risk_manager role or higher can be assigned to a Risk Response task
• C. The risk admin role is required to assign the Risk Response task
• D. The Risk Response task is automatically progressed through the states using a workflow

Answer: (D)

Risk Response tasks in ServiceNow IRM are governed by a workflow that drives their lifecycle. The workflow defines the states a task can move through—such as open, in progress, implemented, and closed—and the conditions or approvals that transition it from one state to the next. Because these transitions are encoded in the workflow, the system automatically progresses the Risk Response task through its states without requiring manual state changes. That automatic progression is what makes this statement true. Note that a risk can have more than one related Risk Response task, especially when multiple controls or remediation actions are tracked separately. Roles alone don’t rigidly restrict who can be assigned to a Risk Response task—the assignment is governed by the configured permissions and rules, not solely by a specific role like risk_manager or risk_admin.

Risk Response tasks in ServiceNow IRM are governed by a workflow that drives their lifecycle. The workflow defines the states a task can move through—such as open, in progress, implemented, and closed—and the conditions or approvals that transition it from one state to the next. Because these transitions are encoded in the workflow, the system automatically progresses the Risk Response task through its states without requiring manual state changes. That automatic progression is what makes this statement true.

Note that a risk can have more than one related Risk Response task, especially when multiple controls or remediation actions are tracked separately. Roles alone don’t rigidly restrict who can be assigned to a Risk Response task—the assignment is governed by the configured permissions and rules, not solely by a specific role like risk_manager or risk_admin.