How to score a Risk
Applies to user roles: Account Owner, Manager, User
Available on platforms: Vatix Workspace web app
Scoring puts every Risk on the same scale, so you can compare them, rank them and see which ones need attention first instead of reading each record to find out. Each score carries a colour, from green at the low end to red at the high end, so a long register can be scanned down a column rather than read.
Every Risk can be scored three ways. 'Inherent risk' is the rating before your existing controls are taken into account, 'Residual risk' is the rating after them, and 'Target risk' is the level you are aiming for once your controls are in place. Scoring inherent and residual risk shows what your controls are worth, and the target shows how far there is still to go.
How to score a Risk
- Go to 'Risk Register' in the left sidebar.
- Click the Risk you want to score. Its record opens on the 'Details' tab.
- Click 'Edit' on the 'Risk Scoring' section. All three matrices become clickable.
- In the 'Inherent' matrix, click the square where the likelihood and the severity meet.
- In the 'Residual' matrix, click the square that reflects the Risk with your controls in place.
- In the 'Target' matrix, click the square for the level you are aiming to reach.
- Click 'Save'.
How to read the matrix
Likelihood runs up the side, with the most likely at the top. Severity runs across the bottom, with the most severe on the right. The number in each square is the score, which is the likelihood multiplied by the severity, so the range is 1 to 25.
As soon as you pick a square, the score and its rating appear underneath that matrix, for example '16 Very high'. An unscored matrix reads 'Not rated'.
What each score means
| Score | Rating | Colour |
|---|---|---|
| 1 to 2 | Very low | Green |
| 3 to 4 | Low | Dark green |
| 5 to 9 | Medium | Yellow |
| 10 to 12 | High | Amber |
| 15 to 16 | Very high | Red |
| 20 to 25 | Extreme | Dark red |
The colour always follows the rating, and the same colours are used on the matrix square, on the record and in the register's scoring columns, so a score reads the same way wherever you meet it. Colour is tied to the rating alone, not to a Risk's status.
The change between the scores
Once the 'Inherent' and 'Residual' matrices are both scored, the arrow between them shows how far the score has moved. Where your controls bring the Risk down, it shows the reduction. Where the residual score is higher than the inherent one, it shows the increase. If the two scores are the same, it reads 'No change'.
The dashed arrow between 'Residual' and 'Target' works the same way, and shows how far the Risk still has to move to reach your target.
How to change or clear a rating
To change a rating, click 'Edit' on the 'Risk Scoring' section and click a different square.
To clear one, click the square that is already selected. The matrix goes back to 'Not rated', which is useful if you have scored the wrong Risk or want to reassess from scratch.
Either way, click 'Save' to keep the change.
Where the scores appear
'Inherent risk' and 'Residual risk' each have their own column in the register, shown as a coloured score with its rating, so you can sort your Risks by exposure and see at a glance which ones need attention. 'Target risk' is available as a column too: switch it on from 'Columns' above the list. See 'How to find, filter and export Risks'.
Note: All three ratings are entered by a person, not worked out from anything else on the record, so a Risk stays as you scored it until somebody scores it again.
Related articles