Risk model
Residual uses one fixed model for all risks: five steps of probability and five steps of impact.
Five by five
Section titled “Five by five”Each assessment rates probability and impact from 1 to 5. The default scales are:
| Value | Probability | Description |
|---|---|---|
| 1 | Very unlikely | Less than 10 percent |
| 2 | Unlikely | 10 to 30 percent |
| 3 | Possible | 30 to 50 percent |
| 4 | Likely | 50 to 80 percent |
| 5 | Almost certain | More than 80 percent |
| Value | Impact | Description |
|---|---|---|
| 1 | Negligible | No effect on objectives |
| 2 | Minor | Minor delay or cost, absorbed in plan |
| 3 | Moderate | Objective at risk, recoverable |
| 4 | Major | Objective missed, escalation needed |
| 5 | Severe | Project or programme untenable |
The project admin can adapt the labels and descriptions of the scales per project. The number of steps is fixed at five.
The score is probability multiplied by impact, from 1 to 25.
Inherent and residual
Section titled “Inherent and residual”- Inherent risk is probability and impact before treatments.
- Residual risk is probability and impact after treatments.
Both are assessed separately and stored separately. Residual risk is never calculated from inherent risk or from the treatments; it is always a rating by a person, with its own rationale.
The heatmap at the top of the Risks page switches between inherent and residual.
Detection as a switch
Section titled “Detection as a switch”The project admin can turn on a third dimension, detection, for the project. Detection is rated from 1 to 5:
| Value | Detection | Description |
|---|---|---|
| 1 | Certain | Would be detected immediately |
| 2 | High | Likely detected before impact |
| 3 | Moderate | May be detected in time |
| 4 | Low | Unlikely to be detected in time |
| 5 | None | Would not be detected |
With detection turned on, the score is probability times impact times detection. The level is still derived from probability times impact only, so the heatmap stays a true five by five matrix.
Level thresholds
Section titled “Level thresholds”The level is derived from probability times impact:
| Level | Probability x impact |
|---|---|
| Low | 1 to 4 |
| Medium | 5 to 9 |
| High | 10 to 15 |
| Extreme | 16 to 25 |
A risk without an assessment is shown as Unrated.
Rationale
Section titled “Rationale”Every assessment requires a written rationale. An assessment without a rationale cannot be saved.
Model version
Section titled “Model version”Every assessment stores the version of the model it was made with, together with the person and the time. The current model version is 1. The model version is also shown in the PDF report, so an auditor can see which scales were in force when a rating was made.