Risk Measures: Likelihood, Impact, and Velocity

Why This Topic Matters
The IIA's Certification in Risk Management Assurance (CRMA) tests your ability to evaluate how an organization identifies, measures, and prioritizes risk. At the heart of every risk assessment are a small number of measures that turn a vague worry into something that can be ranked, compared, and acted upon. The three most commonly tested are likelihood, impact, and velocity. If you misunderstand how these dimensions interact, you will misjudge risk ratings, misread heat maps, and misinterpret questions about risk appetite and response. Examiners love this area because it sits at the intersection of theory (COSO ERM, ISO 31000) and practice (what an internal auditor actually does when assessing a risk register).

What the Risk Measures Are

1. Likelihood (Probability)
Likelihood is the possibility that a given risk event will occur within a defined time horizon. It may be expressed:
- Qualitatively: Rare, Unlikely, Possible, Likely, Almost Certain.
- Quantitatively: a percentage (e.g., 20% chance in the next 12 months) or a frequency (e.g., once every five years).
Key point: likelihood must always be tied to a time frame. A 10% chance over one year is very different from a 10% chance over ten years. COSO ERM (2017) uses the term likelihood and notes that it can be described using probability, frequency, or qualitative terms.

2. Impact (Consequence / Severity)
Impact is the magnitude of the effect if the risk event occurs. It is measured against the organization's objectives and can be:
- Financial: dollar loss, revenue reduction, cost overrun.
- Non-financial: reputational damage, regulatory sanctions, safety incidents, operational disruption, strategic goal failure.
Impact scales typically run from Insignificant to Catastrophic. Good practice defines each level with concrete criteria (e.g., "Major = loss between $1M and $10M, or regulatory fine, or national media coverage") so that different assessors rate consistently.

3. Velocity (Speed of Onset)
Velocity describes how quickly a risk event, once triggered, produces its impact on the organization. It is sometimes called speed of onset or time to impact. Examples:
- High velocity: a cyber-attack that encrypts systems within hours; a sudden commodity price spike; a product recall triggered by a viral social-media post.
- Low velocity: demographic shifts eroding a customer base over a decade; gradual regulatory tightening; slow degradation of infrastructure.
Velocity matters because it determines how much reaction time management has. Two risks with identical likelihood and impact scores may demand very different responses if one gives you months of warning and the other gives you minutes. COSO ERM explicitly lists velocity (along with persistence, adaptability, complexity, and recovery) as a dimension that enriches a basic likelihood-impact assessment.

Related Measures You Should Also Recognize
- Persistence / Duration: how long the impact lasts once it occurs.
- Recovery (Resilience): how quickly the organization can return to normal.
- Vulnerability: how susceptible the organization is, given existing controls and preparedness.
- Inherent vs. Residual Risk: inherent risk is assessed before considering controls; residual risk is what remains after controls. Likelihood and impact are typically rated at both levels.

How It Works in Practice

Step 1: Define the scales. Organizations usually adopt a 3-, 4-, or 5-point scale for likelihood and impact, with written descriptors for each level. Consistency and clarity of definitions are what the auditor should evaluate.

Step 2: Rate each risk. Risk owners or workshop participants assign a likelihood score and an impact score. Where velocity is used, a third score (e.g., Slow / Moderate / Rapid / Immediate) is added.

Step 3: Combine into a risk rating. The simplest method is Risk Score = Likelihood x Impact. A 5x5 scale yields scores from 1 to 25. Some organizations weight impact more heavily (e.g., Likelihood x Impact squared) because a catastrophic low-probability event often deserves more attention than its simple product suggests.

Step 4: Visualize on a heat map. Likelihood is plotted on one axis and impact on the other; colors (green/amber/red) indicate priority zones. Velocity is often shown as a third dimension using bubble size, a symbol, or a separate column in the risk register, because a two-dimensional heat map cannot display it directly.

Step 5: Compare to risk appetite and tolerance. Risks above the appetite line require a response: avoid, reduce (mitigate), share (transfer), or accept. High-velocity risks frequently call for pre-planned responses such as crisis playbooks, business continuity plans, and early-warning key risk indicators (KRIs), because there will be no time to design a response after the event starts.

Step 6: Monitor and reassess. Likelihood and impact change as the environment and controls change. Internal audit evaluates whether the assessment is refreshed periodically and whether KRIs are linked to the measures.

Worked Example
Risk A: Data center flood. Likelihood = 2 (Unlikely), Impact = 5 (Catastrophic), Velocity = Rapid. Score = 10.
Risk B: Loss of key supplier. Likelihood = 4 (Likely), Impact = 3 (Moderate), Velocity = Moderate (weeks of notice). Score = 12.
On a pure likelihood-x-impact basis, Risk B ranks higher. But when velocity is considered, Risk A demands an immediate response plan (backup site, failover testing) because there would be no time to react, while Risk B can be addressed through supplier diversification over a reasonable horizon. This illustrates why the CRMA emphasizes going beyond two dimensions.

Internal Audit's Role
As assurance providers, internal auditors do not own the risk ratings but evaluate whether:
- Scales are clearly defined and consistently applied.
- Ratings are supported by evidence or reasoned judgment, not just gut feel.
- Both inherent and residual positions are considered.
- Velocity and other dimensions are factored in where relevant.
- Ratings are aggregated appropriately and reported to the board in a way that supports decision-making.
- Risk responses are proportionate to the combined measures.

Exam Tips: Answering Questions on Risk Measures: Likelihood, Impact, and Velocity

Tip 1: Memorize the definitions precisely. Likelihood = probability of occurrence. Impact = magnitude of consequence. Velocity = speed from trigger to impact. If a question describes "how fast the organization feels the effect," the answer is velocity, not likelihood.

Tip 2: Watch for the time-frame trap. Any likelihood statement without a time horizon is incomplete. If an answer option says likelihood should be "assessed over a defined period," it is usually correct.

Tip 3: Recognize when velocity changes the priority. Questions often present two risks with the same likelihood-x-impact score and ask which should be prioritized or which needs a pre-planned response. The high-velocity risk is the one requiring contingency planning, KRIs, and crisis readiness.

Tip 4: Distinguish inherent from residual. If a question mentions "before considering controls," it is inherent risk. If it mentions "after controls are in place," it is residual. Controls typically reduce likelihood, impact, or both; some (like business continuity plans) primarily reduce impact and improve recovery rather than likelihood.

Tip 5: Know what a heat map can and cannot show. A standard heat map plots likelihood versus impact. It does not natively display velocity, persistence, or recovery. If asked about a limitation of heat maps, this is a strong answer.

Tip 6: Match the response to the measure. Reducing likelihood = preventive controls (segregation of duties, access controls, training). Reducing impact = detective and corrective controls, insurance, redundancy. Addressing velocity = early-warning indicators, scenario planning, crisis response capability. Sharing (transfer) typically addresses impact, not likelihood.

Tip 7: Think like an assurance provider, not a risk owner. CRMA questions frequently ask what internal audit should do. The right answer evaluates the process (consistency of scales, evidence for ratings, alignment with appetite) rather than assigning the ratings itself. Avoid options where internal audit "determines" or "sets" management's risk ratings; that impairs independence.

Tip 8: Be cautious with multiplication logic. Low likelihood x catastrophic impact can produce a modest numerical score, yet such risks (black swans, tail risks) may still warrant board attention. If an option acknowledges the limitation of simple multiplication for high-impact, low-probability events, it is often the best answer.

Tip 9: Link measures to risk appetite and tolerance. Appetite is the broad amount of risk the organization is willing to accept; tolerance is the acceptable variation around specific objectives. Risk ratings are meaningful only when compared to these thresholds.

Tip 10: Eliminate options using COSO and ISO vocabulary. COSO ERM 2017 uses "likelihood" and "impact" and lists velocity, persistence, adaptability, complexity, and recovery as additional dimensions. ISO 31000 uses "likelihood" and "consequence." Options that confuse these terms or invent non-standard measures are usually distractors.

Quick Recall Summary
- Likelihood: Will it happen? (probability, frequency, time-bound)
- Impact: How bad? (financial and non-financial, against objectives)
- Velocity: How fast? (speed of onset, reaction time available)
- Combine them, plot them, compare to appetite, respond, monitor, and as an auditor, evaluate the quality and consistency of each step.