Study Guide
Assessing Risk
Qualitative and quantitative assessment, reading a 5 × 5 risk matrix, the limits of risk scores, and why a CVSS score is not a business-risk assessment.
Lesson 5.4 Governance, Risk & Compliance
Once a risk has been described, someone has to decide how serious it is compared with everything else competing for attention. This lesson explains the two ways of doing that, how to read a 5 × 5 risk matrix, and why a vulnerability’s technical score is only one input. It continues the customer-database scenario from Risk.
Stage: Think
Which problem first?
A school has money to fix one problem this term.
- The hall roof leaks a little every time it rains, which is most weeks. Buckets catch the water; nothing is damaged.
- The science block could be destroyed by a fire in its old wiring. There has never been a fire, and an electrician thinks one is unlikely but possible.
Think it through
Which would you fix first, and what did you have to weigh up to decide?
- Hint 1: How often does each problem happen, or might it happen?
- Hint 2: How bad would each be if it happened?
- Hint 3: Would two people deciding this agree, unless they used the same words for “often” and “bad”?
Show what happens
Most people weigh two things: how likely each problem is, and how bad it would be. The roof is almost certain but minor; the fire is unlikely but severe. Neither answer is obvious, and two people can disagree unless they agree what “likely” and “bad” mean. A risk assessment makes that weighing consistent, so that risks can be compared and the reasons can be checked.
Stage: Explain
Qualitative and quantitative assessment
There are two ways to say how big a risk is, and a weather forecast uses both. “Heavy rain likely” is a description. “An 80% chance of 12 millimetres” is a measurement. Both are useful, for different purposes.
Risk = Impact × Likelihood is the usual starting point. What the answer means depends entirely on what kind of numbers go into it.
Qualitative assessment uses descriptions: Low, Medium and High, or a score from 1 to 5. Giving the descriptions numbers does not turn them into measurements. They are ordinal, which means they put things in order, like finishing positions in a race. Second place is behind first, but it is not “twice” first. In the same way a likelihood of 4 is higher than a 2 without being twice as likely.
Quantitative assessment estimates quantities with meaningful units, such as pounds lost per incident and an expected event frequency. Numerical detail does not eliminate uncertainty: scope, assumptions, evidence quality and changes in the environment still affect the estimate.
Check your understanding
Show the answer
Answer: A. A is rated more likely than B, but not twice as likely.
Ratings like these are ordinal: 4 is higher than 2, but the scale says nothing about how much higher.
Reading the 5 × 5 matrix
A score only means something if the organisation has written down what each number stands for. Here are the scales a fictional organisation uses.
| Score | Likelihood: how often is it expected? | Impact: how bad would it be? |
|---|---|---|
| 1 | Not expected in the next five years | A nuisance: under an hour’s disruption, no personal information involved |
| 2 | Possible, but not expected this year | Minor: a few hours’ disruption, or a little non-sensitive information exposed |
| 3 | Could well happen once this year | Moderate: a day’s disruption, or some personal information exposed |
| 4 | Expected about once this year | Major: several days’ disruption, or many people’s personal information exposed |
| 5 | Expected several times this year | Severe: the organisation cannot operate, or highly sensitive information about many people is exposed |
With those definitions, two people rating the same risk have something to agree or disagree about. The matrix multiplies the two scores.
Likelihood increases upwards; impact increases to the right. Each cell shows likelihood × impact and an illustrative risk band.
| Likelihood ↑ / Impact → | 1Minor | 2Limited | 3Moderate | 4Major | 5Severe |
|---|---|---|---|---|---|
| 5Almost certain | 5Medium | 10High | 15High | 20Very high | 25Very high |
| 4Likely | 4Low | 8Medium | 12High | 16High | 20Very high |
| 3Possible | 3Low | 6Medium | 9Medium | 12High | 15High |
| 2Unlikely | 2Low | 4Low | 6Medium | 8Medium | 10High |
| 1Rare | 1Low | 2Low | 3Low | 4Low | 5Medium |
Illustrative bands: Low 1–4 · Medium 5–9 · High 10–16 · Very high 17–25. Organisations define their own scales and escalation thresholds; these are not universal acceptance limits.
In this example, likelihood 4 and impact 5 give 4 × 5 = 20. In this illustrative matrix, that falls in the Very high band. It helps prioritise a discussion within the chosen scheme; it is not £20 of loss, a 20% probability or a universal acceptance decision.
Stage: Experiment
Try it: rate a risk
Think it through
Show the answer
Answer: C. They score the same, but need different responses.
Both score 1 × 5 = 5 × 1 = 5. The matrix gives them the same rank, but a rare disaster and a frequent nuisance call for different responses, which the score alone hides. Try it in the panel.
Choose a likelihood and an impact. The panel multiplies them, places the score in the matrix’s band and lists every other rating with the same score. In the grid, the chosen cell is marked and cells with the same score are outlined.
Very high Likelihood 4 × impact 5 = 20, in the Very high band.
The same score comes from likelihood 5 × impact 4.
The scales and bands are a fictional organisation’s, as in the 5 × 5 matrix. The score ranks risks within this scheme; it is not a measurement.
Important limits of ordinal scoring are:
- The intervals are not necessarily equal. A category rated 4 is not necessarily twice as likely as category 2. A score of 20 is not evidence of twice the expected loss of a score of 10.
- The product hides differences. Likelihood 1 × impact 5 and likelihood 5 × impact 1 both produce 5, but a rare severe event and a frequent minor event can need different responses.
- Labels need definitions. “Likely” needs a time horizon and assessment criteria. “Severe” needs consequences that make sense for this organisation.
- Boundaries are choices. The coloured bands here are illustrative. Another organisation may set different escalation thresholds and must document why.
The matrix supports communication and comparison when applied consistently. It should accompany a scenario, evidence, assumptions and an owner, rather than replace them. High impact alone also does not determine the overall risk without considering likelihood and context.
Stage: Explain
Choosing between qualitative and quantitative assessment
| Aspect | Qualitative | Quantitative |
|---|---|---|
| Inputs | Descriptive ratings, such as Low to High or 1 to 5, defined by the organisation. | Estimates with units, such as pounds per incident and incidents per year. |
| Output | A ranking or band that supports discussion and prioritisation. | An estimated loss figure, such as Annualised Loss Expectancy. |
| Strengths | Quick, works when data is scarce and is easy to communicate. | Can be compared directly with the cost of a control. |
| Limits | The numbers are rankings, and the band boundaries are choices. | Only as good as the data and assumptions, and can look more precise than it is. |
| Example in this guide | The 5 × 5 risk matrix. | SLE × ARO = ALE. See Quantifying Impact. |
Many organisations use both: a matrix to sort a long list of risks, and quantitative estimates for the few where a spending decision needs one. Whichever method an organisation uses, its own documented methodology, with defined scales, criteria and owners, is what governs real decisions. The scales in these lessons are simplified teaching examples.
Check your understanding
Show the answer
Answer: B. Quantitative: a loss estimate can be set against the cost.
A quantitative estimate, such as an expected loss per year, can be compared directly with the cost of the control. A band cannot, which is why organisations often use both.
Stage: Discover
Technical severity and business risk
CVSS (the Common Vulnerability Scoring System) gives a software weakness a severity score from 0 to 10. A score of 9.8 is in the top band, critical. It describes how serious the weakness is in general: how easy it is to use and how much damage it could do.
Think it through
A CVSS score says nothing about any particular organisation, so a CVSS score is not a business-risk assessment.
To see the difference, take two systems in the fictional organisation that both have the same weakness, scored 9.8.
| Consideration | System A | System B |
|---|---|---|
| System | Internet-facing application with sensitive customer information. | Isolated test system containing synthetic data. |
| Technical finding | The severe vulnerability remains a valid finding. | The same vulnerability remains a valid finding. |
| Exposure to examine | Which external routes and accounts can reach the affected service? | Is the claimed isolation effective, and are there access paths through users, administration or dependencies? |
| Business consequences | Disclosure and disruption may affect customers and essential operations. | Synthetic data may reduce disclosure consequences, but interruption or onward access may still matter. |
| Decision | Assess evidence, impact and treatment urgency in context. | Assess the actual controls and dependencies; do not equate “test system” with zero risk. |
Now rate both on the organisation’s 5 × 5 scales.
- System A, likelihood. It can be reached by anyone on the internet, and the weakness is publicly known. An attempt is expected this year: 4.
- System A, impact. Many customers’ personal information would be exposed and the service would be down for days: 5.
- System A, score. 4 × 5 = 20, in the Very high band. It goes to the top of the list.
- System B, likelihood. The assessor first checks the claim that it is isolated, and finds that it can be reached only from two administrators’ computers. An attack is possible but not expected: 2.
- System B, impact. Its data is made up for testing, so nothing personal can be exposed, and losing it for a few hours would hold up one team: 2.
- System B, score. 2 × 2 = 4, in the Low band. It is still fixed, at the next routine update.
The result: one weakness, one CVSS score of 9.8, and two risk scores of 20 and 4. Nothing about the weakness differs between them. What differs is who can reach the system and what would be lost.
Change one fact. Suppose step 4 had found that System B was not really isolated, because an administrator’s account could reach both it and System A. System B would then be a stepping stone to the customer data, and its rating would rise sharply. “It is only a test system” is a claim to check, not a reason to stop looking.
The working runs in one direction only. A CVSS score cannot be converted straight into a matrix rating, a probability or an ALE value: the organisation’s own facts have to be added.
FIRST’s CVSS guidance distinguishes intrinsic Base characteristics from Threat and Environmental considerations. Using those additional metrics can refine severity for the relevant conditions, but still does not replace the organisation’s wider assessment of loss, obligations and objectives.
The security report should retain the finding and its technical severity, explain exposure and potential impact, recommend action and identify uncertainty. An authorised owner decides the response and records any acceptance or escalation. Limited resources do not make the finding disappear, and risk acceptance cannot cancel applicable obligations. See GRC for decision ownership and Security Documentation for supporting records.
Stage: Explain
Evidence-based, not fear-based
Security programmes should be evidence-based rather than fear-based. In assessment, that means recording why each rating was chosen, what evidence supports it and what is uncertain. A rating that nobody can explain is hard to challenge, compare or update when things change.
A useful risk assessment can be reviewed by someone else. For each rated risk, record the scenario in a sentence, the likelihood and impact ratings with their reasons, the evidence used, the owner and when it will be reviewed. That record is what lets a manager make, and later defend, a decision.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Work out both scores, then ask what each problem would actually need.
Show the answer
Answer: B. Disagree: a rare disaster and a frequent nuisance need different plans.
The scores tie, but the risks are different in kind: one needs recovery planning for a rare disaster, the other a fix for a frequent annoyance. The matrix ranks; it does not choose the response.
Apply it
- Hint 1: What did the assessor do first for System B?
Show the answer
Answer: C. Check who can really reach it and what it could affect, then rate it.
Keep the finding and its score, check the claimed isolation and what the printer could reach, and rate it on the organisation’s scales. That rating, not the CVSS score alone, sets the priority.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Estimated pounds lost per incident multiplied by expected incidents per year.
Financial loss and expected frequency have meaningful units. Numbered categories can remain ordinal: arithmetic does not turn ranks into measured probabilities or pounds. Quantitative estimates still depend on assumptions.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: False
Category intervals need not be equal, and a product of ranks is not a financial-loss ratio. Retain the scenario, evidence, time horizon and uncertainty alongside a prioritisation score.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: Whether each service is internet-facing and reachable by relevant attackers.; Information sensitivity, operational dependencies and potential harm.; Evidence that isolation or other controls actually work.
Base severity describes technical characteristics, not an incident probability or complete business risk. Exposure, consequences and effective controls can make the organisational risks different, even with the same technical finding.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Study and revision
Practise assessment methods and CVSS in context through the Risk Management topic. The questions are learning-only, with no verified exam alignment.
Stage: Consolidate
What to remember
- Qualitative assessment ranks risks with defined descriptions; quantitative assessment estimates quantities with units.
- Matrix scores are rankings. A score of 20 is not twice a score of 10, and equal scores can hide different risks.
- Scales need written definitions, or two people’s ratings cannot be compared.
- CVSS describes a weakness, not the risk to this organisation; exposure and impact have to be added.
- Record the reasons and evidence for every rating, so that the decision can be checked.
Common misunderstandings
Matrix ratings are rankings. The steps between them are not equal, so their products cannot be compared as ratios.
Numbers organise judgements. They are only as reliable as the evidence and the definitions behind them.
CVSS describes technical severity. Priority also depends on exposure, business impact, existing controls and the organisation’s criteria.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 3 (see the Session 3 Learning Log): Risk = Impact × Likelihood; the CVSS 9.8 example; technical severity and business risk as different questions; the consultant’s role in documenting findings for an authorised decision.
- Taught in Session 4 (see the Session 4 Learning Log): qualitative and quantitative assessment; the 5 × 5 risk matrix; CVSS in context; evidence-based rather than fear-based security.
- Moved from an earlier lesson: “Qualitative and quantitative assessment”, “Reading the 5 × 5 matrix” and “Technical severity and business risk” were previously part of Risk and keep their headings and anchors here; their wording was revised on 13 October 2026. They develop the supplied, reconstructed GRC educational reference, which gives the System A and System B comparison. No vulnerability identifier or scoring vector was supplied for the CVSS 9.8 example, so none is given.
- Supplementary explanation: the weather-forecast comparison, the explanation of ordinal numbers, the fictional five-point likelihood and impact scales, the ratings given to System A and System B on them with the “change one fact” variation, the worked before-and-after rating, the comparison table, the practical note and the misunderstandings. The matrix scales and bands are illustrative, not an organisation’s actual methodology.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the school roof-and-wiring opening, every question asked in the lesson with its feedback and hints, the college and printer examples, the rating panel and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. I have not carried out a professional risk assessment.
The expected yearly loss from a risk, calculated as ALE = SLE × ARO.
The expected number of times an incident occurs per year. Once every four years is 0.25; twice a year is 2.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A standard for rating the technical severity of vulnerabilities. The same base score can carry different business risk depending on context.
Information becoming accessible to an unauthorised party. Disclosure threatens confidentiality, even if the original information is unchanged.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
How serious the consequences of an event would be for the organisation and the people affected.
How probable it is that a defined event will happen over a stated period.
Assessing risk with descriptive ratings, such as Low, Medium and High, often shown in a risk matrix.
Assessing risk with numerical estimates that have real units, such as pounds lost per incident and incidents per year.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A grid that rates likelihood against impact, often on 1 to 5 scales, to rank risks into bands.
The estimated loss if a particular incident happens once.
A potential cause of harm, such as an attacker seeking unauthorised access.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.