Summary

A risk's score is likelihood (1 to 5) multiplied by impact (1 to 5). The level is High at 10 or more, Medium at 5 or more, otherwise Low. There are three levels; there is no Critical.
Residual risk is the same formula applied after subtracting what each treatment removes. A treatment with its own likelihood and impact removes the difference in scores; a treatment without them removes a flat 3.
Reports are immutable snapshots with their own YYYY.N version. Generating one does not create evidence; to count toward coverage the exported file must be uploaded and linked to the requirement.

Concepts

Term	Values
Likelihood	Rare 1, Unlikely 2, Possible 3, Likely 4, Certain 5
Impact	Negligible 1, Minor 2, Moderate 3, Major 4, Catastrophic 5
Score	Likelihood times impact, 1 to 25
Level	Low, Medium, High; stored on the risk
Risk status	Identified (default), Assessing, Mitigating, Monitoring, Resolved, Accepted, AI inferred
Treatment	Planned, In progress, Completed, or Cancelled; optional own likelihood and impact, owner, due date, and linked evidence item

How it works

Inherent level

Score is likelihood times impact. A score of 10 or more is High, 5 to 9 is Medium, and 1 to 4 is Low.

Impact ↓ / Likelihood →	Rare 1	Unlikely 2	Possible 3	Likely 4	Certain 5
Negligible 1	Low 1	Low 2	Low 3	Low 4	Medium 5
Minor 2	Low 2	Low 4	Medium 6	Medium 8	High 10
Moderate 3	Low 3	Medium 6	Medium 9	High 12	High 15
Major 4	Low 4	Medium 8	High 12	High 16	High 20
Catastrophic 5	Medium 5	High 10	High 15	High 20	High 25

The level is written when a risk is created and recomputed whenever likelihood or impact changes, so the stored value and the formula always agree.

About Critical

Some views colour the top of the scale (17 to 25) more strongly than the rest of the High band, but the scoring rule never produces a fourth level. A score of 20 is stored, filtered, and reported as High.

Residual level

With no treatments, residual equals inherent. Otherwise:

Start from the inherent score.
For each treatment that has its own likelihood and impact, subtract the difference between the inherent score and the treatment's score, but never less than 0.
For each treatment without its own likelihood and impact, subtract a flat 3.
Floor the result at 1 and map it to a level with the same thresholds as above.

Points to note: treatment status is not consulted, so a Planned or Cancelled treatment reduces the residual just as a Completed one does; a treatment whose own score is higher than the inherent score reduces by 0, never increases; reductions add up across treatments and the residual score is floored at 1, so enough treatments always reach Low.

Vendor risk uses different thresholds

Vendors use the same 1 to 5 scales but different cut-offs: High at 15 or more, Medium at 8 or more, otherwise Low. A likelihood and impact pair that is High on a risk (score 10) is Medium on a vendor. See Vendor risk and questionnaire AI.

Generated risks

Organizational Risks Generation runs during onboarding and whenever you click Generate. It asks the AI model for two to three risks per category across security, operational, financial, and compliance, using your organization context, and inserts them with status AI inferred so they are visibly unreviewed. Because you started it, you are notified when it starts, completes, or fails. See AI and Cortex for what the model receives.

The same model backs treatment suggestions: one treatment per request, created as Planned, and its suggested resulting likelihood and impact must be lower than the inherent values.

The risk log

Each risk keeps its own log: created, updated, deleted, treatment created, updated, or deleted, control linked or unlinked, and owner changed. A level recomputation is part of "updated"; there is no separate "level changed" entry.

Reports

Five report types exist. Each maps to a catalog evidence item, a report id, and the controls it evidences.

Report	Evidence item	Report id	Controls
Risk Assessment Report	`E-RM-04`	`NORU-REP-01`	`RM-02`
Risk Treatment Plan Summary	`E-RM-05`	`NORU-REP-02`	`RM-02`, `RM-08`
Compliance Review Summary	`E-RM-07`	`NORU-REP-03`	`RM-04`
Corrective Actions Summary	`E-RM-08`	`NORU-REP-04`	`RM-04`, `RM-09`
Vendor Risk/Agreement Summary	`E-TPM-19`	`NORU-REP-05`	`TPM-13`, `TPM-02`

Generate reads live data, takes the latest report of that type, computes the next version with the same YYYY.N rule used for policies (restarting each year), and stores the whole report together with who generated it. The stored report is never updated afterwards; only stored snapshots can be exported.

Export PDF renders the stored snapshot, not live data, as an A4 document with scripts disabled.

How a report reaches a control

Generating a report writes no evidence record. Reports reach controls in two indirect ways:

The control list shows a report count, computed from the report types whose control list includes the control.
The risk module auto-links module-link evidence for the risk-management report requirements (E-RM-04, E-RM-05, E-RM-08, E-RM-18, E-RM-22) pointing at Risk Management → Reports. Module links are context only and never qualify for coverage.

To make a report count toward coverage, export the PDF, upload it to the Evidence Vault, set it Valid, and link it to the requirement (for example E-RM-04 on RM-02).

Edge cases and failure modes

The level did not change after editing a treatment. The stored level is inherent; residual is computed on display. Check the residual figure, not the register column.
A cancelled treatment still lowers residual risk. Status is ignored by the residual formula. Delete the treatment if it should not count.
Two risks with score 20 and 12 both say High. Three bands only; sort by score when you need finer ranking.
A vendor and a risk with identical inputs show different levels. The thresholds differ (10 and 5 versus 15 and 8).
Generated risks look real. They are inserted with status AI inferred and should be reviewed; they are not distinguished by title or category.
A report shows stale numbers. It is a snapshot from the moment you clicked Generate; generate again for a new version.
PDF export failed on a very large report. Rendering has an upper bound; narrow the scope and generate again.
Report generated, coverage unchanged. Expected; see above.

What you can influence

Likelihood and impact on each risk and on each treatment; the second pair is what drives residual.
Treatments: add, complete, or delete them; only existence and their own scores matter to the formula.
Status and owner are yours; AI inferred is a prompt to review, not a verdict.
Reports: when to generate a new snapshot, and whether to upload the export as evidence.

Risk scoring and reports