A risk assessment where the control has to change something RISK
The matrix is not the hard part: it multiplies two guesses. What makes an assessment worth having afterwards is that it says what was known, what was done, and what was left.
What is being assessed
Likelihood and severity each run one to five, so the score runs one to twenty-five. The bands are a convention, not a measurement: the product of two estimates cannot be more accurate than the estimates.
The hazards
What this assessment says about itself
Reassessments
A dynamic risk assessment is a sequence. The one made on arrival and the one made twenty minutes later are both evidence, and keeping only the latest throws away the thing anybody will want to see.
The assessment
How it works
RISK keeps a risk assessment where the controls have to change something. The likelihood and severity matrix is the easy part; what makes an assessment worth having later is a record of what was known, what control was added, and the score before and after it. It keeps earlier versions so the history is visible. The bands are yours to set. It is kept in this browser.
Doing this often? The OBSCURA Sovereign Suite keeps a full risk register with a heat map, an exceptions register and the controls behind each risk. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.