Scoring a risk
You score a risk by choosing its likelihood and its impact on each dimension, measured against your group’s criteria set. The system computes the inherent and residual scores, the tier and the band.
Who may do it: the Risk Champion for their own team’s risks, while the risk is in draft or has been returned. See Roles and permissions.
What you score, and what the system computes
Section titled “What you score, and what the system computes”| You choose | The system computes |
|---|---|
| Likelihood — one level on the criteria set’s likelihood scale | Inherent risk — the score before controls |
| Impact on each dimension — financial, regulatory, operational, reputational, and any dimension your group defines | Residual risk — the score after the effectiveness of the controls (Controls and control testing) |
| Tier and Rating band — from the score, on the bands of the criteria set |
The Criteria set is owned by the group root and applies to every entity beneath it. It describes each likelihood and impact level, how the dimensions combine into a score, and the bands. Every entity in the group scores on the same set, so the group’s figures consolidate.
Scoring steps
Section titled “Scoring steps”- Open the risk in your entity’s risk register.
- Choose the Likelihood level whose description fits the risk.
- Choose a level for each Impact dimension.
- Assess the effectiveness of the risk’s controls.
- Read the inherent score, residual score, tier and band that the system shows.
- Before you submit, run the coverage check.
Coverage check
Section titled “Coverage check”The coverage check lists the risks in your filing that have not yet been scored, and the dimensions on each risk that are still missing. Use it before you submit, so the Reviewer receives a complete filing.
What the system does or refuses
Section titled “What the system does or refuses”- No rating is typed. There is no field for a score, tier or band; they are derived from your choices. See Computed, never typed.
- Residual risk can never be higher than inherent risk. The system does not record a residual score above the inherent score.
- The criteria set is the group’s. An entity scores on the set that applies to it and cannot change it.
- Locked after submission. Scores cannot be changed once the filing is submitted, until it is returned or reopened.