Risk Calculation: Assessment of each risk is based on two factors: and Likelihood Impact. The impact (or consequence) of a risk occurring is assessed as Very High = 5, High = 4, Medium = 3, Low = 2, or Very Low = 1. Impact is the potentially negative effects of an incident or situation to the ability of an organization to execute its mission and achieve its strategic objectives. Each impact score should include, at a minimum, an assessment of mission disruption, economic impact, and external visibility (reputational impact). The resulting scores will be calculated automatically in a risk assessment workbook provided. The scales used for each impact category is shown in the following table: CONSEQUENCE ASSESSMENT SCORE VERY HIGH = 5 HIGH = 4 MEDIUM = 3 LOW = 2 VERY LOW = 1 More than 2, less More than 4, less At least 1, no More than 8 than 4 No more than 1 than 8 more than 2 infrastructures infrastructures infrastructure (or infrastructures infrastructures (or systems or (or systems or system or (or systems or (or systems or networks) networks) network) Mission networks) networks) Disruption affected; major affected; affected; or affected; major affected; minor disruption to moderate minor disruption disruption to disruption to agency disruption to to an agency agency agency program(s) agency program program(s) program(s) program(s) More than $10 More than $5 More than $1 More than $50 Less than $1 Economic Impact million and less million and less and less than $5 million million than $50 million than $10 million million Visibility of risk Visibility of risk in with US Visibility of risk reports by GAO, Visibility of risk at Population, with other federal IG, CRS, or the Administrator Visibility of risk including government External Visibility federal media and Deputy at the mainstream agency (i.e., Federal Administrator Component level media coverage (agencies) or News Radio, level and public department(s) etc.) interactions Impact Score The likelihood of a risk occurring is assessed as Very High = 5, High = 4, Medium = 3, Low = 2, or Very Low = 1. Likelihood is the chance of an incident happening or a situation occurring, defined in the table below as probabilities of occurrence. LIKELIHOOD ASSESSMENT VERY HIGH = MEDIUM = VERY LOW = HIGH = 4 LOW = 2 Score 5 3 1 Mission Somewhat Very Likely Uncertain Not Likely Very Unlikely Disruption Likely Economic Somewhat Very Likely Uncertain Not Likely Very Unlikely Impact Likely
Risk Calculation: Assessment of each risk is based on two factors: Likelihood and Impact. The impact (or consequence) of a risk occurring is assessed as Very High = 5, High = 4, Medium = 3, Low = 2, or Very Low = 1. Impact is the potentially negative effects of an incident or situation to the ability of an organization to execute its mission and achieve its strategic objectives. Each impact score should include, at a minimum, an assessment of mission disruption, economic impact, and external visibility (reputational impact). The resulting scores will be calculated automatically in a risk assessment workbook provided. The scales used for each impact category is shown in the following table: CONSEQUENCE ASSESSMENT VERY HIGH = 5 HIGH = 4 MEDIUM = 3 LOW = 2 VERY LOW = 1 SCORE Mission Disruption More than 8 infrastructures (or systems or networks) affected; major disruption to agency program(s) More than 4, less than 8 infrastructures (or systems or networks) affected; major disruption to agency program(s) More than 2, less than 4 infrastructures (or systems or networks) affected; moderate disruption to agency program(s) At least 1, no more than 2 infrastructures (or systems or networks) affected; minor disruption to agency program(s) No more than 1 infrastructure (or system or network) affected; or minor disruption to an agency program Economic Impact More than $50 million More than $10 million and less than $50 million More than $5 million and less than $10 million More than $1 and less than $5 million Less than $1 million External Visibility Visibility of risk with US Population, including mainstream media coverage and public interactions Visibility of risk in reports by GAO, IG, CRS, or federal media (i.e., Federal News Radio, etc.) Visibility of risk with other federal government agency (agencies) or department(s) Visibility of risk at the Administrator and Deputy Administrator level Visibility of risk at the Component level Impact Score The likelihood of a risk occurring is assessed as Very High = 5, High = 4, Medium = 3, Low = 2, or Very Low = 1. Likelihood is the chance of an incident happening or a situation occurring, defined in the table below as probabilities of occurrence. LIKELIHOOD ASSESSMENT VERY HIGH = 5 HIGH = 4 MEDIUM = 3 LOW = 2 VERY LOW = 1 Score Mission Disruption Very Likely Somewhat Likely Uncertain Not Likely Very Unlikely Economic Impact Very Likely Somewhat Likely Uncertain Not Likely Very Unlikely