# Risk Assessment Scoring Rubric

**Reference Document:** REF-ERM-001
**Version:** 1.0 | **Effective:** July 1, 2026

---

## Quick Reference Card

Use this rubric when assessing any enterprise risk. Score both Likelihood and Impact, then multiply for the Risk Score.

---

## 📊 LIKELIHOOD (How likely is this to occur in the next 12 months?)

| Score | Label | Probability | Ask Yourself |
|:-----:|-------|:-----------:|--------------|
| **1** | Rare | <5% | Has this *ever* happened here or at similar companies? Would it take a perfect storm? |
| **2** | Unlikely | 5-25% | Has it happened once or twice in the industry? Would multiple things need to fail? |
| **3** | Possible | 25-50% | Could this realistically happen? Have we seen near-misses? |
| **4** | Likely | 50-75% | Has this happened before? Are the conditions present for it to happen again? |
| **5** | Almost Certain | >75% | Is this already happening or expected soon without action? |

**Tip:** Consider existing controls. A risk might be inherently likely but controlled down to "Unlikely" due to mitigations already in place.

---

## 💥 IMPACT (What's the worst realistic outcome?)

Score using the **highest applicable category** across all dimensions:

### Financial Impact
| Score | Label | Range | Examples |
|:-----:|-------|:-----:|----------|
| **1** | Negligible | <$10K | Minor rework, small write-off |
| **2** | Minor | $10K-$50K | Project delay, overtime costs |
| **3** | Moderate | $50K-$250K | Lost deal, significant remediation |
| **4** | Major | $250K-$1M | Major client loss, litigation costs |
| **5** | Severe | >$1M | Existential threat, massive liability |

### Operational Impact
| Score | Label | Duration | Examples |
|:-----:|-------|:--------:|----------|
| **1** | Negligible | <1 day | Brief system slowdown, minor inconvenience |
| **2** | Minor | 1-3 days | Single system outage, workaround available |
| **3** | Moderate | 3-7 days | Core system down, clients impacted |
| **4** | Major | 1-4 weeks | Extended outage, SLA breaches, staff overtime |
| **5** | Severe | >1 month | Business operations halted, recovery uncertain |

### Reputational Impact
| Score | Label | Visibility | Examples |
|:-----:|-------|:----------:|----------|
| **1** | Negligible | Internal | Issue contained, no external awareness |
| **2** | Minor | Limited | Trade press mention, few stakeholders aware |
| **3** | Moderate | Industry | Industry coverage, competitor awareness |
| **4** | Major | National | Mainstream media, social media attention |
| **5** | Severe | Sustained | Ongoing negative coverage, customer exodus |

### Compliance Impact
| Score | Label | Consequence | Examples |
|:-----:|-------|:-----------:|----------|
| **1** | Negligible | Finding | Minor audit observation, easy fix |
| **2** | Minor | Non-conformity | Requires action plan, no external reporting |
| **3** | Moderate | Inquiry | Regulatory questions, audit escalation |
| **4** | Major | Investigation | Formal investigation, potential findings |
| **5** | Severe | Action | Fines, sanctions, loss of certification |

---

## 🧮 RISK SCORE CALCULATION

```
Risk Score = Likelihood × Impact
```

### Risk Heat Map

|   | Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 |
|:-:|:--------:|:--------:|:--------:|:--------:|:--------:|
| **Likelihood 5** | 5 🟢 | 10 🟡 | 15 🟠 | 20 🔴 | 25 🔴 |
| **Likelihood 4** | 4 🟢 | 8 🟡 | 12 🟡 | 16 🟠 | 20 🔴 |
| **Likelihood 3** | 3 🟢 | 6 🟢 | 9 🟡 | 12 🟡 | 15 🟠 |
| **Likelihood 2** | 2 🟢 | 4 🟢 | 6 🟢 | 8 🟡 | 10 🟡 |
| **Likelihood 1** | 1 🟢 | 2 🟢 | 3 🟢 | 4 🟢 | 5 🟢 |

---

## 🚦 RISK LEVELS & REQUIRED ACTIONS

| Level | Score | Color | Required Action | Timeline |
|-------|:-----:|:-----:|-----------------|----------|
| **Critical** | 20-25 | 🔴 Red | Immediate escalation to ERC/Exec; mitigation plan required | 24-48 hours |
| **High** | 15-19 | 🟠 Orange | ERC notification; mitigation plan required | 7 days |
| **Medium** | 8-14 | 🟡 Yellow | Document treatment decision; monitor | 30 days |
| **Low** | 1-7 | 🟢 Green | Accept and monitor; review quarterly | Quarterly |

---

## ✅ ASSESSMENT CHECKLIST

When scoring a risk, confirm you have considered:

- [ ] **Timeframe:** Are you assessing for the next 12 months?
- [ ] **Existing Controls:** Does the score reflect controls already in place?
- [ ] **Worst Realistic Case:** Impact should be worst *plausible* outcome, not worst *possible*
- [ ] **All Impact Dimensions:** Check Financial, Operational, Reputational, and Compliance
- [ ] **Supporting Evidence:** Can you explain your scoring if challenged?

---

## 📝 EXAMPLE ASSESSMENTS

### Example 1: Key Person Dependency (ERR-01)
> "Only one person knows the Workday ERP system"

- **Likelihood:** 4 (Likely) — Person could leave, get sick, or be unavailable
- **Impact:** 5 (Severe) — Payroll/financials halted, audit failure
- **Score:** 4 × 5 = **20 (Critical)** 🔴

### Example 2: Shadow IT Tools (ERR-14)
> "Marketing uses WeTransfer for large files"

- **Likelihood:** 4 (Likely) — Already happening, no controls
- **Impact:** 3 (Moderate) — Data could leak, compliance gap
- **Score:** 4 × 3 = **12 (Medium)** 🟡

### Example 3: Clearance Latency (ERR-11)
> "6-18 month delay to clear new personnel"

- **Likelihood:** 4 (Likely) — Inherent to the process
- **Impact:** 4 (Major) — Could miss staffing for contracts
- **Score:** 4 × 4 = **16 (High)** 🟠

---

## 🔄 REASSESSMENT TRIGGERS

Re-score a risk when:
- Mitigation activities complete
- New incident or near-miss occurs
- Business context changes significantly
- Control effectiveness changes
- 90 days since last assessment (minimum)

---

*Questions? Contact the ERC or VP of IT, Security & Compliance.*