Risks

You judge likelihood and impact, Certaria does the arithmetic. How inherent and residual scores are calculated and kept consistent.

Audience: ISMS Admin, and anyone who owns a risk.

Where: the Certaria app, under Risk and Assets.

The division of labour: you judge likelihood and impact. Certaria calculates the scores. That split exists so scoring stays consistent across everyone who uses the register, rather than depending on who was filling it in that day.

What Certaria calculates

Whenever a risk is added, or its likelihood or impact changes, Certaria works out and writes back:

The inherent score, before your controls.
The residual score, left after your controls.
The resulting risk level.

It happens on save. There is no button and no wait.

What is yours to decide

Likelihood and impact. These are judgements about your organisation and Certaria will not make them for you.

What the controls are. The residual score assumes controls exist. Naming them, and being able to show they work, is the substance behind the number.

The treatment decision. Accept, mitigate, transfer or avoid, and who owns the outcome. A risk with a residual score and no owner is a number, not a treatment.

Your appetite. What level you are prepared to live with. The register cannot tell you whether a Medium residual risk is acceptable, and the answer differs by organisation and by risk.

Keeping it alive

A risk register written once during certification and never revisited is a common audit finding, and an obvious one: every entry carries the same date.

Review the register at each management review, and record that you did.
Re-score when something changes: a new supplier, a new system, an incident that showed a control did not hold.
Close risks that no longer apply, with a reason, rather than deleting them.

An incident is often the strongest signal that a risk was scored optimistically. Re-scoring after one is good practice and reads well at audit.

What an auditor asks

How did you arrive at this score? Your likelihood and impact judgement, and the method that turned it into a level.
What are you doing about the high ones? The treatment, its owner, and the tasks or corrective actions carrying it.
When did you last look at this? Which is why the review cadence matters more than the initial scoring.

Common failure modes

Symptom	Cause	Fix
Scores did not update	Neither likelihood nor impact changed, so nothing recalculated	Change one of the inputs. Editing other fields does not re-score
Residual equals inherent everywhere	No controls have been credited against the risks	Record the controls. Identical scores usually mean the mitigation was never captured
Every risk has the same date	The register was written once and not reviewed	Review at each management review and record it
A high risk has no owner	It was scored but never treated	Assign an owner and a treatment. Scoring is not treating

Incidents and concerns, which frequently change a score
The Statement of Applicability
The compliance summary