Leadership wants a single red/yellow/green score for every city system without defined likelihood or impact criteria. What should the risk practitioner insist on?

Risk ratings that use red/yellow/green colors are only meaningful after a scoped analysis methodology defines likelihood and impact criteria. Without explicit scales, color scores become subjective labels that cannot be compared across city systems or defended to auditors and executives. Publishing only green ratings to manage public optics, assigning colors randomly, or using vendor logos as risk indicators all substitute appearance for analysis. A municipal risk program needs consistent criteria—for example, defined likelihood bands and impact dimensions covering confidentiality, integrity, availability, safety, and financial or service disruption—before any dashboard color is assigned. Exam caveat: CISSP emphasizes qualitative or quantitative analysis methods with clear criteria; traffic-light summaries are communication aids, not a substitute for methodology. Operational check: document the risk analysis approach, train assessors on the scales, apply them consistently in workshops, and only then map residual risk to colors for leadership reporting. Revisit criteria when new regulatory or safety impacts appear so ratings remain comparable over time. Retain the underlying likelihood and impact scores behind each color so disputes can be resolved with evidence rather than taste.