Scoring a risk is only half the job. Risk evaluation is the decision that follows: given where this risk sits and how much risk we're willing to carry, what do we actually do about it?
Start with appetite
Risk appetite is the line an organisation is willing to live with — the amount of risk it will accept in pursuit of its objectives. Set it explicitly (we'll tolerate up to Medium, say) and every risk sorts itself into “fine as is” or “needs action” without argument.
The four responses
- Accept — the residual risk is within appetite; monitor it and move on.
- Mitigate (treat) — add or strengthen controls to bring it down.
- Transfer — shift it to someone better placed to carry it (insurance, a contract clause).
- Avoid — stop doing the thing that creates the risk.
Appetite decides which of these is on the table; the residual score decides how urgent it is.
Where the tool does this
Our free 5×5 tool has appetite built in: set your line, and every risk in the register is flagged accept or treat automatically, so evaluation falls straight out of the assessment.
Try it now — free.
Score your risks on the 5×5 matrix, apply your controls, set an appetite, and see the response for each one. Up to 10 risks, no account needed.
Open the free tool