Business units submit risk assessments using their own scoring scales, ranging from three-point to ten-point ratings with different definitions. The information security manager must present an enterprise view of the top risks. What is the BEST action?
Select an answer to reveal the explanation.
Short Explanation
You can't compare scores when one judge uses a three-point card and another uses a ten. Everyone needs the same scale with the same definitions. The trap is a math trick like converting to percentages, which makes different yardsticks look comparable when they're not.
Full Explanation
An enterprise view of risk requires that ratings mean the same thing across units. That comes from a standard methodology with common likelihood and impact scales, shared definitions for each level and consistent criteria, applied by every unit. Once in place, results can be aggregated, ranked and compared with the enterprise risk appetite in a defensible way. Converting scores to percentages changes the arithmetic but not the meaning: a three on one unit's scale and a seven on another's were defined against different criteria, so percentage values remain incomparable and create a misleading appearance of consistency. Presenting each unit's results separately pushes the comparison onto senior management without giving them a basis for it, and the top enterprise risks remain unidentified. Re-scoring centrally within the security team removes the business owners who understand impact and turns risk assessment into an IT opinion that the units may then dispute. Exam caveat: a common methodology can still allow units to add local detail, as long as the core scales and definitions are shared. Operational check: confirm the methodology is approved by management, published to all units, and that the next assessment cycle uses the common scales throughout.