Risk methodology
Settings → Organization → Risk methodology (organisation administrators)
The risk methodology is your organisation's approved basis for scoring risk. Every level you see in the product — on the register, in an assessment, on the heat maps, in the board pack and the engagement report — comes from it, so a score means the same thing everywhere.
Level bands
A score is likelihood × impact on a 5 × 5 matrix, from 1 to 25. The bands set where each level starts:
| Level | Default | Means |
|---|---|---|
| Critical | from 15 | 15–25 |
| High | from 8 | 8–14 |
| Medium | from 4 | 4–7 |
| Low | below 4 | 1–3 |
Set your own to match your approved methodology — for example Critical from 12. Each level must start higher than the one below it. Changing the bands relabels existing scores; the scores themselves do not change.
Likelihood and impact criteria
Each of the five likelihood steps and five impact steps has a short label and the criteria behind it — "Likely: about once a year", "Major: serious effect on objectives, customers or compliance". Write them in English and Arabic.
The criteria are shown to whoever scores a risk: on the new-risk form, in Edit on a risk, and in the assessment workspace. That way "4" always means what your methodology says it means.
Who can change it
Only an organisation administrator. Every save is recorded in the audit log with the methodology before and after, so you can show a regulator which basis applied when.
Reset to defaults puts back the bands and criteria the product ships with.