ISO 27001 clause 6.1.2 / ISO 31000

Risk Methodology

How your organisation scores risks: likelihood × impact on a 5×5 scale, rating bands, appetite and acceptance rules. Used by the Risk Register and Treatment Plan.

likelihood scale
1
2
3
4
5
impact scale
1
2
3
4
5
Rating bands & appetite
Risk matrix
5 Almost certain
5
10
15
20
25
4 Likely
4
8
12
16
20
3 Possible
3
6
9
12
15
2 Unlikely
2
4
6
8
10
1 Rare
1
2
3
4
5
1 Negligible
2 Minor
3 Moderate
4 Major
5 Severe

Impact →, Likelihood ↑. Outlined cells are within appetite.

Treatment options
Modify / Mitigate

Apply controls to reduce likelihood or impact.

Retain / Accept

Consciously accept the risk within appetite, with owner sign-off.

Share / Transfer

Pass part of the risk to insurers, suppliers or partners.

Avoid

Stop the activity that creates the risk.