Initial rating
The initial rating reflects the risk before any controls are applied — how likely and how severe it would be with nothing in place.
Residual rating
The residual rating reflects the risk after existing controls are taken into account — usually lower than the initial rating.
Final rating
The final rating is calculated from likelihood and consequence using your organisation's configured matrix, giving a consistent score to compare risks against each other.
Was this helpful?
