How to score a Risk
Applies to user roles: Account Owner, Manager, User
Available on platforms: Vatix Workspace web app
Scoring puts every Risk on the same scale, so you can compare them, rank them and see which ones need attention first instead of reading each record to find out. Each score carries a colour, from green at the low end to red at the high end, so a long register can be scanned down a column rather than read.
Every Risk is scored twice. 'Inherent risk' is the rating before your existing controls are taken into account, and 'Residual risk' is the rating after them, so scoring both also shows what your controls are worth.
Note: Risk Register is currently available to a limited number of organisations. If you don't see it in your left sidebar, contact your Account Owner. Account Owners can contact their Vatix account manager to find out more.
How to score a Risk
- Go to 'Risk Register' in the left sidebar.
- Click the Risk you want to score. Its record opens on the 'Details' tab.
- Click 'Edit' on the 'Risk Scoring' section. Both matrices become clickable.
- In the 'Inherent' matrix, click the square where the likelihood and the severity meet.
- In the 'Residual' matrix, click the square that reflects the Risk with your controls in place.
- Click 'Save'.
How to read the matrix
Likelihood runs up the side, with the most likely at the top. Severity runs across the bottom, with the most severe on the right. The number in each square is the score, which is the likelihood multiplied by the severity, so the range is 1 to 25.
As soon as you pick a square, the score and its rating appear underneath that matrix, for example '16 Very high'. An unscored matrix reads 'Not rated'.
What each score means
| Score | Rating | Colour |
|---|---|---|
| 1 to 2 | Very low | Green |
| 3 to 4 | Low | Dark green |
| 5 to 9 | Medium | Yellow |
| 10 to 12 | High | Amber |
| 15 to 16 | Very high | Red |
| 20 to 25 | Extreme | Dark red |
The colour always follows the rating, and the same colours are used on the matrix square, on the record and in the register's two scoring columns, so a score reads the same way wherever you meet it. Colour is tied to the rating alone, not to a Risk's status.
The change between the two scores
Once both matrices are scored, the arrow between them shows how far the score has moved. Where your controls bring the Risk down, it shows the reduction. Where the residual score is higher than the inherent one, it shows the increase. If the two scores are the same, it reads 'No change'.
How to change or clear a rating
To change a rating, click 'Edit' on the 'Risk Scoring' section and click a different square.
To clear one, click the square that is already selected. The matrix goes back to 'Not rated', which is useful if you have scored the wrong Risk or want to reassess from scratch.
Either way, click 'Save' to keep the change.
Where the scores appear
Both ratings have their own column in the register, shown as a coloured score with its rating, so you can sort your Risks by exposure and see at a glance which ones need attention. See 'How to find, filter and export Risks'.
Note: Both ratings are entered by a person, not worked out from anything else on the record, so a Risk stays as you scored it until somebody scores it again.
Related articles