Hi @Valqe ,
Firstly, welcome to the risk world in IRM.
What you are using is the Classic Risk management, where the Risk Score Rollup doesn't happen, which means Inherent & Residual impact/likelihood scores will remain the same as on the risk statement.
Ratings are of three kinds: qualitative, semi-quantitative, and quantitative.
Qualitative rating
Qualitative risk assessments rely on the assessor's perceptions of the probability and impact of a risk. If the method is purely qualitative, then the ratings are based on the list values such as high, medium, or low. In this case, the risk scores do not roll up. Because this method has minimal mathematical dependency, qualitative risk assessment is easy and quick to perform. This method also enables an organization to take advantage of the assessor's experienced knowledge of the process or asset that is being assessed. Users who are new to risk assessments usually use this kind of rating.
Semi-quantitative rating
In a semi-quantitative rating, the qualitative ratings also have a corresponding numerical scale. For example, if the quantitative risk score is between 0-10, then the qualitative rating is low. Users who use this type of rating are not new to risk assessments. Most users belong to this category. In this category, the risk scores roll up and the risk appetite is qualitative in nature.
Quantitative rating
A quantitative risk assessment focuses on data that is fact-based, measurable, and highly mathematical. In a quantitative risk rating that uses advanced simulation techniques, the risk is quantified in purely numerical terms. In this category, the risk appetite is quantitative in nature. You can choose only one Scoring type for Classic risk.
The Risk Scoring Calculations for classic risk is as follows:
The inherent and residual scores for risk are calculated using the risk criteria, likelihood, and impact. Use the following calculations to score risks:
- Qualitative Inherent ALE = Inherent ARO x Inherent SLE
- Qualitative Inherent Score = Inherent Likelihood x Inherent impact
- Quantitative Residual ALE = Residual ARO x Residual SLE
- Qualitative Residual Score = Residual SLE
When scoring is set to qualitative, the quantitative values are updated in the background.
The Calculated Score for risk is a read-only field designed to quickly assess a risk affecting the organization, and identify threats and areas of non-compliance.
If controls are implemented to mitigate risk, then
- Calculated ALE = Residual ALE + ((Inherent ALE - Residual ALE) * (Calculated Risk Factor / 100)).
- So: Calculated Score = Residual Score only if Compliance with the controls is 100%.
If the Calculated Score > Residual Score, the organization is not 100% compliant with the controls used to mitigate risk.
Meaning that the Calculated Score can never be less than the Residual Score or greater than the Inherent Score.
If controls are not implemented to mitigate risk, then Calculated Score = Residual Score.
If the Residual Score is not set, then Calculated Score = Inherent Score.
The calculated risk factor value is calculated as:
- Calculated Risk Factor = (Indicator failure factor + Control failure factor) / 2
Control failure factor -> Sum of failed controls weighting divided by total controls weighting.
Indicator failure factor -> Uses the last result of each associated indicator. The number of last results failed divided by the total number of indicators associated.
If you want to see the scoring should gets affected based on Inherent, residual and control effectiveness, then you will have to move to Advanced Risk Management, Where the Risk Rollup happens, with the use of RAMs and Risk Statements has NO contribution.
Risk score rollup in Advanced Risk Assessment
