You are here:
How Risk Score Is Calculated for Change Requests
The risk score for a change request is calculated using a weighted formula that evaluates change request attributes and optional questionnaire responses. The system produces a numeric score and assigns a corresponding risk level of Low, Medium, High, or Critical.
Required Editions
| Available in: Lightning Experience |
| Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service. |
How the Calculation Works
The risk score is calculated using a weighted sum formula:
Risk Score = Σ (Answer Point Value × Attribute Weight)Each factor contributes to the total score based on two components: the point value for the selected answer and the weight assigned to that factor. The system evaluates all applicable factors and sums their contributions to produce the final risk score.
The calculation operates in two modes:
- Baseline Mode: Uses only the 5 change request attributes to calculate a score between 15 and 45. Risk levels: Critical (>37), High (31–37), Medium (24–30), Low (15–23).
- Enhanced Mode: Activated when the risk evaluation questionnaire is completed. Uses attributes plus 10 questionnaire responses to calculate a score between 42 and 138. Risk levels: Critical (>115), High (93–115), Medium (69–92), Low (42–68).
Starting in Summer '26, questionnaire responses are preserved when change request attributes are updated. In previous releases, the risk score incorrectly reset to baseline mode when a change request was modified, even if a questionnaire had been completed.
If you upgraded to the Summer '26 release and your risk scores still reset to baseline mode, the corrected flow may not have deployed automatically.
To resolve this, delete your existing active flow for risk evaluation. Navigate to Salesforce Go and turn off the Change Risk Score feature on the Change Management page. Refresh the page and turn the feature back on. This ensures the updated flow template deploys to your org.
Change Request Attributes
The following change request attributes are always included in the risk calculation. Each attribute has an assigned weight that determines its relative importance, and each answer option has a point value.
| Attribute | Weight | Answer | Point Value | Contribution |
|---|---|---|---|---|
| Impact | 3 | High | 3 | 3 × 3 = 9 |
| Medium | 2 | 3 × 2 = 6 | ||
| Low | 1 | 3 × 1 = 3 | ||
| Urgency | 3 | High | 3 | 3 × 3 = 9 |
| Medium | 2 | 3 × 2 = 6 | ||
| Low | 1 | 3 × 1 = 3 | ||
Schedule Lead Time (Days between creation and estimated end date) |
3 | 0–5 days | 3 | 3 × 3 = 9 |
| 6–15 days | 2 | 3 × 2 = 6 | ||
| > 15 days | 1 | 3 × 1 = 3 | ||
Associated Issues (Total incidents and problems linked to the change) |
3 | > 7 incidents or problems | 3 | 3 × 3 = 9 |
| 2–6 incidents or problems | 2 | 3 × 2 = 6 | ||
| 0–1 incidents or problems | 1 | 3 × 1 = 3 | ||
| Change Type | 2 | Emergency | 3 | 2 × 3 = 6 |
| Normal | 2 | 2 × 2 = 4 | ||
| Standard | 1 | 2 × 1 = 2 |
Risk Evaluation Questionnaire Questions
When a user completes the risk evaluation questionnaire, the system adds 10 additional factors to the calculation. Each question has an assigned weight and multiple answer options with corresponding point values.
| Question | Weight | Answer | Point Value | Contribution |
|---|---|---|---|---|
| How critical is the impact of this change on a configuration item (CI) or business service? | 3 | Critical | 3 | 3 × 3 = 9 |
| Somewhat Critical | 2 | 3 × 2 = 6 | ||
| Not Critical | 1 | 3 × 1 = 3 | ||
| How complex is this change? (Consider the number of impacted CIs, tasks, and teams.) | 3 | Complex | 3 | 3 × 3 = 9 |
| Somewhat Complex | 2 | 3 × 2 = 6 | ||
| Easy | 1 | 3 × 1 = 3 | ||
| What is the level of difficulty to roll back this change? | 3 | Not roll back possible | 4 | 3 × 4 = 12 |
| Complex | 3 | 3 × 3 = 9 | ||
| Somewhat Complex | 2 | 3 × 2 = 6 | ||
| Easy | 1 | 3 × 1 = 3 | ||
| Is there a redundancy plan in place for this change? (A backup system or component that can take over if the infrastructure fails.) | 3 | No | 2 | 3 × 2 = 6 |
| Yes | 1 | 3 × 1 = 3 | ||
| When is this change scheduled to be implemented? | 3 | Moratorium Window | 5 | 3 × 5 = 15 |
| Peak Business Hours | 4 | 3 × 4 = 12 | ||
| Non-Peak Business Hours | 3 | 3 × 3 = 9 | ||
| Non-Business Hours | 2 | 3 × 2 = 6 | ||
| Maintenance Window | 1 | 3 × 1 = 3 | ||
| What is the implementation team's experience with similar changes? | 3 | New to the activity | 3 | 3 × 3 = 9 |
| Familiar with the activity | 2 | 3 × 2 = 6 | ||
| Expert at the activity | 1 | 3 × 1 = 3 | ||
| What is the duration of the implementation window? | 2 | Insufficient time to implement, verify, and roll back within the window | 3 | 2 × 3 = 6 |
| Moderate risk of exceeding implementation window to implement, verify, and roll back | 2 | 2 × 2 = 4 | ||
| Adequate time to implement, verify, roll back, and deal with issues | 1 | 2 × 1 = 2 | ||
| How many hours are required to implement this change? | 2 | > 4 hours | 3 | 2 × 3 = 6 |
| 1–4 hours | 2 | 2 × 2 = 4 | ||
| < 1 hour | 1 | 2 × 1 = 2 | ||
| Is the environment stable to support this change? | 2 | Unstable | 3 | 2 × 3 = 6 |
| Somewhat Stable | 2 | 2 × 2 = 4 | ||
| Stable | 1 | 2 × 1 = 2 | ||
| Can the change be tested post deployment? | 2 | No ability to test | 3 | 2 × 3 = 6 |
| Ability to test partially | 2 | 2 × 2 = 4 | ||
| Ability to test fully | 1 | 2 × 1 = 2 |
Example Calculation
A database migration change request is created and a user completes the risk evaluation questionnaire. The system calculates the risk score by summing the contributions from all attributes and questionnaire responses.
Step 1: Calculate Attribute Contributions
- Impact: High (point value 3) × weight 3 = 9
- Urgency: Medium (point value 2) × weight 3 = 6
- Schedule Lead Time: 12 days (point value 2) × weight 3 = 6
- Associated Issues: 3 incidents (point value 2) × weight 3 = 6
- Change Type: Normal (point value 2) × weight 2 = 4
Attribute Subtotal: 9 + 6 + 6 + 6 + 4 = 31
Step 2: Calculate Questionnaire Contributions
- Critical CI impact (point value 3) × weight 3 = 9
- Complex change (point value 3) × weight 3 = 9
- Complex rollback (point value 3) × weight 3 = 9
- No redundancy plan (point value 2) × weight 3 = 6
- Non-peak business hours (point value 3) × weight 3 = 9
- Team familiar with activity (point value 2) × weight 3 = 6
- Moderate window risk (point value 2) × weight 2 = 4
- 1–4 hours implementation (point value 2) × weight 2 = 4
- Somewhat stable environment (point value 2) × weight 2 = 4
- Fully testable (point value 1) × weight 2 = 2
Questionnaire Subtotal: 9 + 9 + 9 + 6 + 9 + 6 + 4 + 4 + 4 + 2 = 62
Step 3: Calculate Total Score and Risk Level
Total Score: 31 (attributes) + 62 (questionnaire) = 93
Risk Level: High (a score of 93 falls in the 93–115 range for enhanced mode)
Customizing Risk Calculation
Admins can customize the weights, point values, and risk level thresholds to align with organizational risk tolerance. To modify the calculation logic, see Modify Change Risk Assessment Logic for IT Services.
