A GRC administrator must configure qualitative scoring for city operational risks using likelihood and impact. Which configuration action is appropriate?
Select an answer to reveal the explanation.
Short Explanation
A 5×5 matrix is the IRM scoreboard: likelihood down one side, impact across the top, and the cell tells you the rating. Configure that matrix in the risk methodology so assessments speak the same language.
Full Explanation
Qualitative risk configuration typically defines scales and a likelihood-impact matrix that assessment methodologies use to derive ratings. Implementing a 5×5 matrix with mapped residual levels is the standard approach. Hard-coded business rules, currency-only scoring, or an unadapted ITSM priority matrix bypass proper risk methodology configuration.