Assessment Criteria − Likelihood

POTENTIAL FOR RISK TO

RATING PREVIOUS OCCURRENCES
OCCUR

Likely to occur several times in 3 Has occurred in the past 3

ALMOST CERTAIN
months months

Possible to occur once every 6 Has occurred in the past 6

POSSIBLE
months months

Has not occurred in the past

RARE Might occur once in 1 year
year
REFERENCE

Likelihood
Likelihood Criteria
Qualitative Rating
Rating (This event is expected to occur…)
5 Almost Certain at least once per week
4 Likely at least once per month
3 Possible at least once every quarter
2 Unlikely at least once every six (6) months
1 Rare at least once per year
Severity - Refer to next sheet
Risk Heat Map

Insignificant
1
Almost Certain Moderate
5 5
Likelihood Rating

Likely Moderate
4 4
Possible Low
3 3
Unlikely Low
2 2
Rare Low
1 1

Risk Treatment and Monitoring

Risk Manager
Risk Score Priority for Treatment
(in-charge for treatment)

Immediate Action is required to

Very High mitigate the risk (Top - Very High Executive Committee (ExeCom)
Priority)
Immediate Action is required to
mitigate the risk (High Priority)
Management Committee (ManCom) /
High
O/D/U Heads

Next priority
Option to formulate action within
specified period, need close
Moderate Director/Division Chief/Unit Head
monitoring of existing controls
 No need to formulate further
Low action, but needs monitoring Division Chief/Unit Head
 Percentage of Involved
Frequency
Persons
90-100% / 9 out of 10 always
61-89% / 6 to 8 out of 10 most of the time
26-60% / 3 to 5 out of 10 sometimes
11-25% / 2 out of 10 rare
10% or less / 1 out of 10 never

Severity Rating
Minor Moderate Major Critical
2 3 4 5
High Very High Very High Very High
10 15 20 25
Moderate High Very High Very High
8 12 16 20
Moderate Moderate High Very High
5 9 12 15
Moderate Moderate Moderate High
4 6 8 10
Low Low Moderate Moderate
2 3 4 5

Treatment
Will Residual Risk be Corrresponding Risk
Monitoring assessed until resolved? Strategy
Period (minimum)
Avoid/Mitigate/Share/Tr
1 month Yes
ansfer

Avoid
1 month Yes
/Mitigate/Share/Transfer

1 month Yes Accept/Mitigate

1 month No Accept
Assessment Criteria − Consequence

COMPLIANCE STRATEGIC
RATING OPERATIONAL IMPACT
Legal/Regulatory Reputational

Management Indictments
Non achievement of Business
MAJOR Damaging
Objectives +1 month delay
Regulatory Sanctions

Regulatory fines
Some objectives may not be
MODERATE achieved and significant delays (1 Minor Issue
day - 1 week)
Regulatory investigation

Limited liabilities or
MINOR Little impact <1 hour None
regulatory impact
Risk Rating Matrix

Major MEDIUM HIGH HIGH VERY HIGH VERY HIGH

CONSEQUENCE

Moderate LOW LOW MEDIUM HIGH HIGH

Minor VERY LOW VERY LOW MEDIUM MEDIUM HIGH

Rare Unlikely Possible Likely Almost Certain

LIKELIHOOD