RER uses a clear, widely understood approach: describe the risk, score its likelihood and impact, decide how to respond, and keep it under review.
Default scales you can adapt to fit your organisation. The important thing is that everyone uses the same ones.
| 1 | RareMay happen only in exceptional circumstances |
| 2 | UnlikelyCould happen, but not expected |
| 3 | PossibleMight well happen at some point |
| 4 | LikelyWill probably happen in most circumstances |
| 5 | Almost certainExpected to happen |
| 1 | InsignificantNegligible effect, easily absorbed |
| 2 | MinorSmall, short-lived disruption or cost |
| 3 | ModerateNoticeable effect on services, finances or reputation |
| 4 | MajorSerious harm to objectives, people or reputation |
| 5 | SevereCritical effect, threatening the organisation's objectives |
Usually tolerated and reviewed periodically.
Managed with existing controls; keep under review.
Needs active treatment and a named owner.
Priority action, escalated to senior leaders.
How serious the risk would be if nothing were done about it.
Where the risk sits today, taking your current controls into account.
The level you're aiming for, in line with your risk appetite.