A utility IRM lead explains the common scoring model used on qualitative risk assessments. What architecture is typically applied?
Select an answer to reveal the explanation.
Short Explanation
Most civic risk scorecards are still “how likely” times “how bad.” Likelihood and impact (significance) are the classic pair—not entity counts or audit sample sizes pretending to be the whole model.
Full Explanation
The common qualitative risk scoring architecture combines likelihood with impact (significance) to produce the risk score. Utility IRM leads use that pair so OT and enterprise risks share a comparable civic scorecard. Multiplying entity count by citation count as the only score fails by concept because inventory and citation volume are not likelihood or impact. Using audit sample size alone as significance fails by concept because sample size is an assurance design choice, not inherent exposure. Dividing open incidents by headcount with no impact dimension fails by concept because incident rates without impact ignore consequence severity. Exam caveat: CIS-RC qualitative scoring typically multiplies or combines likelihood and impact/significance. Operational check: open the qualitative methodology for the utility framework, confirm factors include likelihood and impact, score a sample risk with both, and verify the resulting risk score derives from that combination. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.