Impact and likelihood
Every unit has two scores, each from 0 to 100:
Impact - how bad it would be if it happened.
Likelihood - how likely it is to happen.
Its severity is impact × likelihood, from 0 to 10,000. Severity falls into a band:
Band | Severity |
|---|---|
High | 4,000 and over |
Medium | 2,000 to 3,999 |
Low | under 2,000 |
Inherent risk
The inherent risk is the risk with no controls at all. It comes from Conform's data pack for your business category. If it doesn't fit your situation, you can override it.
Residual risk
The residual risk is what's left once your controls are taken into account. Each control reduces the impact, the likelihood, or both, by its strength:
a control you've Confirmed reduces the risk by its full strength;
a Partial control reduces it by its strength × how effective it is;
a control Not in place or Not applicable doesn't reduce it at all.
Reductions multiply rather than add, so two 50% controls take a score down to a quarter, never to zero. A risk is never fully removed.
Why residual matters
Residual risk is what's compared with your risk appetite, and what the Overall Risk Picture shows by default. It's only as good as your confirmations, which is why Testing checks them.