Risk score = impact × likelihood. A simple equation, but all its value lies in the discipline of the scales it is measured against — otherwise the numbers are just impressions in disguise.
1 The impact scale
Impact is defined concretely at each level, financially and non-financially, so that two people do not score the same risk differently:
| Level | Financial impact | Non-financial impact |
|---|---|---|
| 1 — Negligible | Under 50,000 | Internal inconvenience with no external effect |
| 2 — Minor | 50,000 – 250,000 | A limited complaint, a day’s delay |
| 3 — Moderate | 250,000 – 1 million | Partial stoppage, a regulatory finding |
| 4 — Major | 1 million – 5 million | A fine, local reputational damage |
| 5 — Severe | Over 5 million | Activity suspended, broad regulatory impact |
2 The likelihood scale
| Level | Description | Approximate frequency |
|---|---|---|
| 1 — Rare | Hard to imagine it happening | Less than once every 5 years |
| 2 — Unlikely | Could happen but has not been seen | Once every 3–5 years |
| 3 — Possible | Has happened at comparable organisations | Roughly once a year |
| 4 — Likely | Has happened to us before | Several times a year |
| 5 — Almost certain | Will happen unless we intervene | Monthly or more |
3 The matrix
Green: acceptable · Yellow: monitored · Red: treated · Dark red: immediate escalation to the board
Watch the bottom-right corner
A rare but severe risk (a warehouse fire, a major breach) has a low numerical score, yet it could end the organisation. That cell is handled with continuity plans and insurance, not by the score alone.
4 Inherent and residual
- Inherent risk: its size if no control existed at all.
- Residual risk: its size after the effect of the controls actually in place.
- The gap between them measures control effectiveness: a narrow gap means weak or inactive controls.
The risk: paying amounts to fictitious suppliers because of weak verification of supplier details.
| State | Impact | Likelihood | Score |
|---|---|---|---|
| Inherent (no controls) | 4 | 4 | 16 — red |
| Residual (with current controls) | 4 | 2 | 8 — yellow |
| Target (after treatment) | 4 | 1 | 4 — green |
The controls reduced the likelihood, not the impact — which is normal: most preventive controls reduce the chance of occurrence, while insurance and continuity plans are what reduce the impact.
5 Risk appetite and tolerance limits
Risk appetite is the amount of risk an organisation willingly accepts in pursuit of its objectives, approved by the board. A tolerance limit is the maximum acceptable deviation before escalation.
| Area | Appetite | Tolerance limit |
|---|---|---|
| Safety and compliance | Very low | No regulatory breach is accepted |
| Credit and collections | Medium | Receivables over 90 days not to exceed 10% |
| Innovation and new product launches | High | An approved cap on experimental spend |
A common mistake
Scoring by gut feel and then justifying it. Fix that with three things: written scales, group rather than individual scoring, and documenting the reason for every score so it can be revisited later.
Lesson summary
- Risk score = impact × likelihood, against scales defined in writing.
- The matrix ranks risks and decides what is treated, what is monitored and what is escalated.
- A rare but severe risk is handled with continuity plans, not by the score alone.
- Inherent is before controls, residual is after them, and the difference measures their effectiveness.
- Risk appetite is approved by the board, and the tolerance limit sets when a matter is escalated.
6 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. A risk with impact 5 and likelihood 1. What is the most appropriate response?
Rare but severe events are managed with impact-reducing tools: continuity plans, insurance and backups.
2. Strong controls cut the likelihood from 4 to 1 while the impact stayed at 4. What do we call the new score of 4?
What remains after the effect of controls is the residual risk, and that is what is compared against the acceptance thresholds.
3. Who approves the risk appetite?
Appetite is a governance decision defining the acceptable range of risk; the board approves it and management works within it.