Risk scoring becomes difficult when several teams bring their assessments to the same meeting. IT rates an internal process failure as high. Security rates an external attack scenario as medium. Supplier assurance reports a critical vendor. Before ranking them, the CISO needs to know whether those labels describe comparable events, consequences, periods and control assumptions.

The practical question is whether another team would assign the same rating to the same scenario using the same evidence. If that answer is unclear, combining the scores creates a league table of different judgements. This article explains how to put internal and external risks on a common basis, govern the resulting decisions and use disagreement to improve the assessment method.

Start by separating the source from the scenario

Internal risks can involve human error, insider misuse, process failures or weaknesses in internal controls. External risks can involve attackers, supplier failures or changes outside the organization. These categories describe origins. They do not establish severity or determine how much influence the organization has over the outcome.

A missed offboarding step is an internal control weakness. A criminal using stolen credentials is an external threat. If both contribute to unauthorized access to the same customer records, they may belong in one loss scenario rather than two independently scored risks.

Keep scenarios separate when their routes to harm or consequences differ materially. Accidental deletion and deliberate disclosure may involve the same system but require different likelihood estimates, impact criteria and responses. Link related scenarios so reviewers can see their shared conditions without treating every finding as another enterprise risk.

NIST IR 8286A Revision 1 describes risk identification through assets, threats, vulnerabilities and consequences. The practical implication is to score the resulting scenario, not merely its internal or external label. [1]

Internal and external causes can contribute to one disclosure scenario, while accidental deletion represents a separate availability scenario.

Calculate risk scores using shared definitions

A simple risk scoring model combines likelihood and impact ratings. On a five-point scale, likelihood 3 multiplied by impact 4 gives a risk score of 12. The arithmetic is simple; the definitions carry the judgement.

Before using that result across teams, agree on four elements:

1. Assessment period. State whether likelihood concerns the next quarter, the next 12 months or another defined period.
2. Event threshold. Define what must happen for the scenario to occur, such as unauthorized disclosure rather than an unsuccessful login attempt.
3. Consequence criteria. Specify the business effects represented by each impact level, including disruption, financial loss, customer harm, data exposure, contractual duties and regulatory obligations.
4. Control state. Compare inherent risk under a defined baseline separately from residual risk with currently implemented controls.

Compliance consequences should be explicit, not implied. If an event could trigger regulatory notification, breach a contractual commitment, affect personal data or interrupt a critical service, the impact criteria should state how that consequence changes the rating. The presence of a regulation alone should not inflate a score; the assessed consequence must still be clear.

Do not assume that a supplier’s overall security rating uses the same definitions. It may describe the supplier’s posture rather than the consequence of a particular failure for your organization. Use relevant supplier observations as inputs, then assess your own scenario.

A score of 12 is an ordering result under the chosen rules. It is not a measured probability, expected financial loss or proof that the scenario is twice as serious as one scoring 6. Keep likelihood and impact visible alongside the combined score, and record the evidence behind both ratings.

Set rating levels and escalation rules before reviewing cases

An organization may use five risk rating levels: very low, low, moderate, high and critical. Define the score ranges, business consequences and required actions for each level before reviewing individual cases. Otherwise, the preferred outcome can influence the rating.

Do not rely exclusively on multiplied ranges. A low-likelihood event with consequences beyond an approved tolerance may require escalation even when its product score falls below the usual high band. Document that override rule in advance. It should identify the impact conditions that trigger escalation and the authority that must review the decision.

The rating and the response are related but different. A high risk may be reduced, avoided, transferred or accepted. Acceptance does not turn the risk into a low risk; it records a governed decision to retain the exposure under stated conditions. NIST IR 8286C Revision 1 recommends common criteria for enterprise comparison and review of disparities between similar scenarios. Aligning column names or converting red to 5 does not resolve incompatible meanings. [2]

Work through two conflicting risk assessments

The following example is illustrative. It is not a customer case.

Two teams assess unauthorized disclosure from the same customer-records application. The internal assessment focuses on retained access after employees leave. The external assessment focuses on stolen credentials. Both identify the same potential disclosure, but they initially use different rating assumptions.

Both teams produce a score of 12, but they use different assessment periods, impact criteria and control assumptions.

The matching numbers conceal disagreement. Neither score should enter a common ranking unchanged. First establish the same period, disclosure threshold, consequence criteria and current control state. Then decide whether retained access and credential theft are alternative routes within one scenario or sufficiently different scenarios to assess separately.

Do not average the two scores to settle the discussion. Reassess the underlying factors. If a team cannot support its likelihood estimate, retain the unresolved range or classification and record the information needed to decide. The workshop may produce one assessment, two linked assessments or a request for further analysis.

Govern who can change or accept a rating

Comparable scoring also requires clear decision rights. The business risk owner should own the response and acceptance decision. Control owners should explain control performance and remediation. Security, compliance, privacy or legal specialists should advise on relevant obligations and challenge unsupported assumptions. The person responsible for a control exception should not be the only person approving the resulting risk acceptance.

For each material risk, retain a decision record containing:

• the approved scenario statement and affected service or asset;
• the assessment period, rating criteria and model version;
• the evidence date, source and known limitations;
• the risk owner, control owners and decision authority;
• the selected response, rationale and required actions; and
• the next review date and expiry date for any risk acceptance or exception.

This record separates a change in exposure from a change in management choice. If leadership accepts a high residual risk, the rating remains high unless the likelihood, consequence or control state changes. The acceptance record explains why the organization is retaining it, who approved the decision and when it must be reviewed. NIST IR 8286 Revision 1 and IR 8286B Update 1 connect cybersecurity risk decisions with enterprise objectives, response selection and communication. [3][4]

Run a calibration session before the next portfolio review

Choose a small set of scenarios spanning internal errors, malicious activity and supplier dependencies. Give identical descriptions and assumptions to assessors from security, IT, compliance and the relevant business function. Ask them to rate independently before discussion.

Compare likelihood and impact separately. A difference of two levels should prompt review of the definitions, supporting information or interpretation. Use three questions: Did we assess the same event? Did we include the same consequences? Did we assume the same controls?

Retain the resolved cases as calibration examples. If legitimate service differences explain different ratings, document those differences. If wording caused the disagreement, revise the scale. Repeat the exercise when new business units, regulatory obligations or supplier-assurance methods enter the reporting process.

Track disagreements by cause. A recurring mismatch over customer or regulatory impact calls for better consequence criteria. Repeated confusion over planned controls calls for a clearer assessment baseline. A pattern of expired evidence calls for a review trigger, not another debate over labels.

Calibration should diagnose the cause of disagreement and identify the correction required.

Manage changes without rewriting the comparison basis

Key Risk Indicators (KRIs) can identify conditions worth reassessing. For the illustrative access scenario, track overdue access removals and unauthorized access events separately. A change in either metric should prompt review of the relevant assumption; neither metric automatically determines the overall rating.

SPOG.AI’s continuous control monitoring connects defined controls with operational evidence to assess coverage and effectiveness. That context can help determine whether the control state used in a residual assessment still applies. [5]

Its governance, risk and compliance offering provides a shared view across services, requirements and control gaps. Use that context to confirm scope and evidence before comparing results. Rating criteria, escalation thresholds and acceptance decisions remain organizational responsibilities. [6]

Before the next management review, select two risks competing for attention. Align their scenarios, periods, consequence criteria, control states and evidence dates. Resolve overlaps and confirm who can approve the response. Only then compare the ratings. The useful conclusion may be a changed priority, but it may also be that the original comparison was never valid.

Frequently asked questions