Risk Criteria and Rating Scales

Introduction
Within the CRMA domain of Evaluating Risk Management Processes, risk criteria and rating scales form the measurement backbone of any risk management framework. They are the standards against which the significance of a risk is judged, and they determine whether the organization treats, tolerates, transfers, or terminates a given exposure. For the internal auditor providing assurance over risk management, understanding how criteria and scales are designed, applied, and governed is essential to forming an opinion on whether the risk management process is effective, consistent, and aligned with the organization's objectives.

Why Risk Criteria and Rating Scales Are Important
Without defined criteria, risk assessment becomes a matter of individual opinion. One manager's 'high' risk is another's 'moderate', and the board receives a risk profile that is inconsistent, unreliable, and impossible to aggregate. Clear criteria and scales matter because they:
• Enable consistency – different business units and assessors evaluate risks using the same yardstick, so results can be compared and consolidated enterprise-wide.
• Link risk to objectives and appetite – criteria translate the board's risk appetite and tolerance statements into practical thresholds that operational staff can apply.
• Support prioritization – rating scales allow management to rank risks and direct limited resources toward the exposures that matter most.
• Drive response decisions – pre-defined thresholds specify when a risk is acceptable, when it requires escalation, and when immediate action is mandatory.
• Provide an audit trail – documented criteria give internal audit an objective basis to test whether risk ratings are supportable and whether the process operates as designed.
• Satisfy framework expectations – both COSO ERM (2017) and ISO 31000:2018 require organizations to establish criteria for evaluating risk as a foundation of the risk assessment process.

What Risk Criteria Are
ISO 31000 defines risk criteria as the terms of reference against which the significance of a risk is evaluated. In practical terms, risk criteria answer the questions: What do we measure? How do we measure it? How much risk is acceptable? They typically include:
• Dimensions to be assessed – most commonly likelihood (probability) and impact (consequence), but potentially also velocity (speed of onset), persistence (duration), vulnerability, interconnectedness, and detectability.
• Definitions for each dimension – what constitutes a 'rare' versus 'almost certain' event, or a 'minor' versus 'catastrophic' impact.
• Impact categories – financial, operational, reputational, regulatory/compliance, health and safety, strategic, environmental, and so on.
• Time horizon – the period over which likelihood is assessed (e.g., within the next 12 months, within the strategic planning cycle).
• Risk appetite and tolerance thresholds – the level of risk the organization is willing to accept in pursuit of objectives and the acceptable variation around that level.
• Combination rules – how likelihood and impact are combined into an overall rating (multiplication, matrix lookup, or weighted formula).
• Escalation and response rules – who must be informed and what action is required at each rating level.
Criteria should be established at the start of the risk management process, derived from organizational objectives, stakeholder expectations, legal and regulatory obligations, and the organization's risk appetite. They must be reviewed and updated as the internal and external context changes.

What Rating Scales Are
Rating scales are the ordered sets of values used to score each dimension of a risk. The most common forms are:

1. Qualitative scales
These use descriptive labels such as Low / Medium / High or Insignificant / Minor / Moderate / Major / Catastrophic. They are quick to apply and easy to communicate, but they rely heavily on the quality of the written descriptors. A well-constructed qualitative scale always includes an anchoring description for each level (for example, 'Major: loss of a key customer, regulatory fine, national media coverage') to reduce subjectivity.

2. Semi-quantitative scales
These assign numeric values to qualitative levels, typically 1 to 5. A likelihood of 4 multiplied by an impact of 5 produces a risk score of 20. Semi-quantitative scales permit ranking and heat-mapping while remaining relatively simple. Their weakness is that the numbers are ordinal, not true measures: a score of 20 is not necessarily 'twice as bad' as a score of 10, and equal scores can arise from very different combinations (a 5×2 and a 2×5 both equal 10 yet may demand different responses).

3. Quantitative scales
These use actual values: probability expressed as a percentage or frequency (e.g., once every 10 years), and impact expressed in monetary terms (e.g., $5 million loss), downtime, number of injuries, or percentage of revenue. Quantitative approaches support expected-loss calculations, value-at-risk, Monte Carlo simulation, and scenario analysis. They are more precise and defensible but require reliable data and more effort, and they can create a false sense of accuracy if underlying assumptions are weak.

Typical likelihood scale (5-point example)
1 – Rare: may occur only in exceptional circumstances (less than 5% in the period)
2 – Unlikely: could occur at some time (5–25%)
3 – Possible: might occur at some time (25–50%)
4 – Likely: will probably occur in most circumstances (50–75%)
5 – Almost certain: expected to occur in most circumstances (greater than 75%)

Typical impact scale (5-point example, multi-category)
1 – Insignificant: loss under $50k; no injury; no regulatory interest; no media coverage
2 – Minor: $50k–$250k; first-aid injury; minor breach handled internally; local media
3 – Moderate: $250k–$1m; medical treatment; regulatory inquiry; regional media
4 – Major: $1m–$10m; serious injury; regulatory penalty; national media; loss of key client
5 – Catastrophic: over $10m; fatality; loss of license; sustained international coverage; threat to viability

How Risk Criteria and Rating Scales Work in Practice
Step 1 – Establish context and appetite. The board and senior management articulate objectives and the risk appetite statement. The risk function translates these into measurable criteria and tolerance limits.
Step 2 – Design the scales. The organization selects the number of levels (3, 4, 5, or more), writes anchoring descriptors for each level and each impact category, and decides whether scales will be qualitative, semi-quantitative, or quantitative. Scales must be calibrated to the organization's size: a $1 million loss is catastrophic for a small charity but insignificant for a multinational.
Step 3 – Assess inherent risk. Risk owners rate each identified risk for likelihood and impact assuming no controls are in place (or assuming controls fail). This produces the inherent (gross) risk rating.
Step 4 – Assess residual risk. After considering the design and operating effectiveness of existing controls, the risk is re-rated to produce the residual (net) risk rating.
Step 5 – Evaluate against criteria. The residual rating is compared to the risk appetite and tolerance thresholds. Risks within appetite may be accepted and monitored; those exceeding tolerance require treatment and escalation according to the pre-defined rules.
Step 6 – Plot and prioritize. Ratings are placed on a risk matrix or heat map, which visually divides the risk universe into zones (often green, amber, red) that correspond to response requirements.
Step 7 – Monitor and review. Criteria and scales are revisited periodically and whenever the context changes materially (new strategy, acquisition, regulatory change, major incident).

Common Design Choices and Their Trade-offs
• Odd versus even number of levels – a 5-point scale offers a neutral midpoint, which can encourage 'central tendency' (everyone scores 3). A 4-point scale forces a choice but may lack granularity.
• Symmetric versus asymmetric matrices – some organizations weight impact more heavily than likelihood so that low-probability, high-impact events are not under-prioritized.
• Single versus multi-dimensional impact – when a risk affects several categories, the organization must decide whether to take the highest category score, an average, or a weighted sum.
• Additional dimensions – velocity, vulnerability, and control effectiveness can be rated separately to enrich the analysis beyond the classic two-factor model.
• Granularity of scores – more levels improve differentiation but increase the chance of spurious precision and assessor disagreement.

Common Weaknesses Internal Auditors Should Look For
• Scales with labels but no anchoring descriptions, leaving interpretation to each assessor.
• Criteria not linked to the board-approved risk appetite, so there is no clear line between acceptable and unacceptable.
• Impact scales expressed only in financial terms, ignoring reputational, safety, or compliance consequences.
• Different business units using different scales, preventing aggregation.
• Confusion between inherent and residual risk, or residual ratings that assume control effectiveness that has never been tested.
• Rating 'compression', where most risks cluster at the midpoint and the matrix fails to discriminate.
• Scales never updated despite significant changes in the organization's size, strategy, or environment.
• Over-reliance on the multiplied score without considering the underlying combination of likelihood and impact.
• Lack of documented rationale supporting individual ratings, so the assessment cannot be challenged or re-performed.
• Risk velocity ignored, so fast-moving risks receive the same priority as slow-developing ones.

The Internal Auditor's Role
When evaluating risk management processes, the CRMA candidate must remember the distinction between assurance and consulting roles set out in the IIA's position paper on ERM and the Three Lines Model. Internal audit can evaluate whether criteria exist, are appropriate, are consistently applied, and are aligned with appetite. Internal audit can facilitate workshops and advise on scale design. Internal audit must not set the risk appetite, own the criteria, or make the final decision on risk ratings, as doing so would impair independence and objectivity. Internal audit may also use the organization's rating scales as an input to its own risk-based audit planning, while applying professional skepticism about their reliability.

Relationship to COSO ERM and ISO 31000
COSO ERM (2017) addresses this topic principally under the Performance component: 'Assesses Severity of Risk' requires the organization to assess risks using defined criteria, and 'Prioritizes Risks' requires criteria such as adaptability, complexity, velocity, persistence, and recovery. The Strategy and Objective-Setting component requires the definition of risk appetite and acceptable variation in performance (tolerance). ISO 31000 places the establishment of risk criteria in the 'Scope, Context and Criteria' step and applies them during 'Risk Evaluation', where risk analysis results are compared with criteria to determine whether additional action is required.

Exam Tips: Answering Questions on Risk Criteria and Rating Scales
1. Anchor every answer to objectives and risk appetite. The CRMA exam repeatedly tests whether you understand that criteria must flow from organizational objectives and the board's risk appetite. If an answer option links criteria to appetite and objectives, it is usually the strongest choice. Options describing criteria set in isolation by the risk function or by internal audit are usually distractors.

2. Distinguish clearly between inherent and residual risk. Expect scenario questions that describe a rating and ask what it represents. Inherent (gross) risk ignores controls; residual (net) risk reflects the effect of existing controls. A common trap is an option that treats residual risk as if controls are effective without any evidence of testing.

3. Know the strengths and weaknesses of each scale type. Qualitative scales: simple, communicable, subjective. Semi-quantitative: allow ranking and heat maps, but numbers are ordinal and can mislead. Quantitative: precise and supports modeling, but data-hungry and can create false confidence. Questions frequently ask which approach is 'most appropriate' for a given context—match the scale to data availability, organizational maturity, and decision needs.

4. Remember that a score alone is not enough. If a question presents two risks with equal scores (e.g., both 12 on a 5×5 matrix), the correct response usually involves examining the underlying likelihood and impact, considering velocity or other factors, or applying management judgment rather than treating them as identical.

5. Look for the consistency theme. Many questions describe different units using different scales or undefined labels. The correct answer typically identifies the lack of common, anchored criteria as the root cause of inconsistent or non-aggregable results.

6. Respect the Three Lines Model. When a question asks what internal audit should do about risk criteria, choose options involving evaluation, assurance, facilitation, or advice. Reject options where internal audit sets appetite, determines final ratings, or owns the risk register.

7. Watch for the 'most appropriate first step' pattern. If an organization lacks criteria, the first step is to establish them based on appetite and context—not to begin rating risks, buy software, or train staff. Sequence matters in CRMA questions.

8. Identify design flaws quickly. Memorize the classic weaknesses: missing descriptors, financial-only impact, no appetite linkage, uncalibrated scales relative to organizational size, central tendency, stale criteria. When a scenario describes one of these, the question is almost certainly testing your ability to spot it.

9. Know framework terminology. Be able to recognize COSO ERM's severity-assessment and prioritization criteria (velocity, persistence, adaptability, complexity, recovery) and ISO 31000's placement of 'risk criteria' in the context-setting step and their use in 'risk evaluation'. Precise vocabulary often separates the correct option from a near-miss.

10. Eliminate absolutes and extremes. Options stating that quantitative methods are 'always' superior, that a 5-point scale is 'required', or that criteria 'never' need updating are typically wrong. The exam rewards balanced, context-dependent judgment.

11. Read for the stakeholder. Questions may ask what the board, management, or internal audit needs from the criteria. Boards need appetite alignment and aggregated views; management needs actionable thresholds and escalation rules; internal audit needs documented, testable criteria. Tailor your answer to the stakeholder named in the stem.

12. Practice with mini-scenarios. Before the exam, work through examples: a risk rated 'high' by one unit and 'medium' by another for the same event; a residual rating lower than inherent with no evidence of control testing; a heat map where 80% of risks sit in the middle cell. For each, articulate the weakness, the risk management principle violated, and the appropriate audit recommendation. This habit builds the rapid pattern recognition the CRMA exam demands.

Summary
Risk criteria define what the organization measures and how much risk it will accept; rating scales provide the calibrated instruments for that measurement. Together they convert abstract risk appetite into operational decisions and give internal audit an objective foundation for assurance. For the CRMA exam, master the linkage to objectives and appetite, the inherent-versus-residual distinction, the trade-offs among qualitative, semi-quantitative, and quantitative approaches, the common design weaknesses, and the boundaries of internal audit's role. With these principles firmly in place, questions on risk criteria and rating scales become opportunities to demonstrate the structured, independent judgment that the CRMA designation certifies.