A GRC administrator must configure qualitative scoring for city operational risks using likelihood and impact. Which configuration action is appropriate?
Select an answer to reveal the explanation.
Short Explanation
A 5×5 matrix is the IRM scoreboard: likelihood down one side, impact across the top, and the cell tells you the rating. Configure that matrix in the risk methodology so assessments speak the same language.
Full Explanation
Qualitative scoring for city operational risks is configured by defining a likelihood × impact matrix (commonly 5×5) in the risk methodology and mapping cells to residual ratings used by assessments. That configuration gives assessors a shared language so comparable civic risks produce comparable ratings. Methodology-bound matrices beat ad hoc scoring embedded in scripts.
Hard-coding every risk score in a business rule that ignores methodology records bypasses governed scoring design and makes changes opaque. Scoring only with currency fields and hiding likelihood abandons qualitative likelihood×impact methodology for a single money dimension. Borrowing the ITSM priority matrix and renaming it without defining risk levels confuses service priority with residual risk rating semantics.
Exam caveat: ITSM priority ≠ risk residual. CIS-RC expects methodology-configured risk scoring matrices, not repurposed incident priority tables.
Operational check: open the risk methodology; confirm the qualitative matrix and cell-to-rating map; run a sample assessment and verify the residual derives from likelihood and impact selections; ensure no business rule overrides methodology scores silently.