How risk scores work
Every assessed risk has a score out of 10 and a level: Low, Moderate, High or Critical. The score comes from two choices you make about the risk: its likelihood and its impact. It helps you see at a glance which risks need attention first.
Likelihood: how likely is it to happen?
Section titled “Likelihood: how likely is it to happen?”| Level | Number | What it means |
|---|---|---|
| Very Low | 1 | The risk is highly unlikely to occur. |
| Low | 2 | The risk is unlikely but possible. |
| Medium | 3 | The risk may occur under certain conditions. |
| High | 4 | The risk is likely to occur. |
| Very High | 5 | The risk is almost certain to occur. |
Impact: how bad would it be?
Section titled “Impact: how bad would it be?”| Level | Number | What it means |
|---|---|---|
| Very Low | 1 | No significant impact on operations or objectives. |
| Low | 2 | Slight disruption with minimal effect on objectives. |
| Medium | 3 | Noticeable impact, may cause operational delays. |
| High | 4 | Significant impact on operations, objectives at risk. |
| Very High | 5 | Critical impact with high probability of failure. |
When you choose a level on a form, its number is shown on the button and its meaning appears underneath.
How the score is worked out
Section titled “How the score is worked out”- VirgilTrack multiplies the two numbers: likelihood × impact. The result is between 1 and 25.
- It spreads that result over a scale from 1 to 10, so the lowest risk (1 × 1) scores 1.0 and the highest (5 × 5) scores 10.0.
For example, a risk with High likelihood (4) and High impact (4) gives 4 × 4 = 16, which scores 6.6.
For readers who want the exact rule: score = 1 + (likelihood × impact − 1) × 9 ÷ 24, shown to one decimal place.
Score levels
Section titled “Score levels”| Level | Score | Badge colour |
|---|---|---|
| Low | Below 3.5 | Green |
| Moderate | From 3.5 up to, but not including, 6.5 | Yellow |
| High | From 6.5 up to, but not including, 8.0 | Orange |
| Critical | 8.0 and above | Red |
The level is always written next to the colour, so you never need to rely on colour alone.
Every combination
Section titled “Every combination”Find the row for the risk’s likelihood and the column for its impact. The cell where they meet shows the score and level.
| Likelihood ↓ / Impact → | Very Low (1) | Low (2) | Medium (3) | High (4) | Very High (5) |
|---|---|---|---|---|---|
| Very High (5) | 2.5 Low | 4.4 Moderate | 6.3 Moderate | 8.1 Critical | 10.0 Critical |
| High (4) | 2.1 Low | 3.6 Moderate | 5.1 Moderate | 6.6 High | 8.1 Critical |
| Medium (3) | 1.8 Low | 2.9 Low | 4.0 Moderate | 5.1 Moderate | 6.3 Moderate |
| Low (2) | 1.4 Low | 2.1 Low | 2.9 Low | 3.6 Moderate | 4.4 Moderate |
| Very Low (1) | 1.0 Low | 1.4 Low | 1.8 Low | 2.1 Low | 2.5 Low |
Where you see the score
Section titled “Where you see the score”- The risk register: the Score column, for example 6.6 · High. See The risk register.
- Adding or assessing a risk: a box under Likelihood and Impact shows the score as soon as you’ve chosen both, for example 6.6 and High risk, with “Risk score out of 10, from likelihood × impact”.
- A risk’s page: a large circle with the score and level, “risk score out of 10”, and a small grid that marks where the risk sits. See A risk’s page.
- The dashboards: the heat map counts open risks by likelihood and impact. See The risk heat map.
A risk that hasn’t been assessed yet has no score. The register shows Not assessed instead. See Assess a risk.
When a score changes
Section titled “When a score changes”A risk has one score. It changes only when someone changes the risk’s Likelihood or Impact, which you do by editing the risk. See Edit a risk.
Adding or finishing controls doesn’t change the score by itself. When you review a risk, ask whether its controls have made it less likely or less harmful, and edit the levels if they have.