Risk framework
Define how your organisation measures, accepts and governs risk. The methodology sets rating scales and severity bands; appetite sets the thresholds you are willing to accept; governance shows who assesses and approves; attestation records sign-off of the framework itself.
Active methodology
Version 1Likelihood scale
| Level | Label | Descriptor | Weight |
|---|---|---|---|
| 1 | Rare | May occur only in exceptional circumstances | 1 |
| 2 | Unlikely | Could occur at some time | 2 |
| 3 | Possible | Might occur at some time | 3 |
| 4 | Likely | Will probably occur in most circumstances | 4 |
| 5 | Almost certain | Expected to occur in most circumstances | 5 |
Impact scale
| Level | Label | Descriptor | Weight |
|---|---|---|---|
| 1 | Minimal | Negligible impact on operations, no regulatory interest | 1 |
| 2 | Minor | Limited impact, contained within a team | 2 |
| 3 | Moderate | Notable impact, management attention required | 3 |
| 4 | Major | Significant impact on important business services or regulatory standing | 4 |
| 5 | Severe | Threatens business viability or brings severe regulatory consequence | 5 |
Severity labels & score bands
| Severity | Label | Weight | Score from | Score to |
|---|---|---|---|---|
| critical | Critical | 4 | 17 | 25 |
| high | High | 3 | 10 | 16 |
| medium | Medium | 2 | 5 | 9 |
| low | Low | 1 | 1 | 4 |
Control credit — how linked controls reduce residual risk
Each linked control's live effectiveness earns credit toward reducing residual risk. Preventative controls reduce likelihood; detective and corrective controls reduce impact. Credit is summed across all controls of that type and capped — residual likelihood and impact never drop below 1.
Review cadence by tier
Review months = how often risks assessed at each tier are re-reviewed. The tier comes from the triage step of the assessment wizard.
| Tier | Review months |
|---|---|
rapid Light-touch review for well-understood, stable risks (assessed via the rapid intake tier). | 12 |
standard The default review depth for most risks. | 12 |
deep Full re-assessment for high-severity, volatile, or heavily-regulated risks. | 6 |
Locked compliance scales
These scales gate compliance and control logic directly and are not tenant-customizable here — the boundary is visible, not hidden. Changing them is its own locked-algorithm decision gate.
- Requirement status — Compliant · Partial · Gap · N/A
- Control effectiveness — Effective · Needs improvement · Not tested
- Evidence description quality — 0–10 rating band
Issue SLA (read-through)
The tenant's action-plan SLA, in force today — edited in Settings → Issue management, not here.