Define the assessment method before comparing risks. The team needs shared meanings for consequence levels, likelihood estimates and the point at which a risk requires a response or escalation.

Use the workspace's actual scales

CSFaaS does not impose the same fixed five-level matrix on every workspace. Review Settings → Risk matrix and Impact matrix to understand the configured levels, labels, consequence domains and thresholds.

The risk matrix combines its displayed threat and vulnerability levels into a likelihood level. The impact matrix supplies descriptions and, where used, monetary bands for each impact type and severity level. These are related parts of the assessment method, not interchangeable scales.

Describe the assumptions behind a rating. State the scenario, time horizon, controls considered and evidence available. Distinguish missing assessment information from a low rating.

Define consequence domains

Maintain Impact Types in Databases → Configuration. A useful definition explains what the domain covers and how to distinguish one severity level from another. Include consequences relevant to your organisation, such as service disruption, harm to people or financial loss.

If monetary values are used, agree the currency and valuation basis. Changing the impact matrix's currency label does not convert existing amounts. Review the underlying numbers when changing the currency or methodology.

Evaluate response options

Assess the options supported by the workflow and appropriate to the scenario:

  • Mitigate: introduce or improve measures that reduce likelihood or consequences.
  • Avoid: discontinue or redesign the activity that creates the exposure, while considering any new risks introduced.
  • Accept: retain the risk through an authorised, documented decision with suitable review conditions.
  • Transfer or share: allocate specified consequences or responsibilities through arrangements such as insurance or contracts; assess what remains with the organisation.

Acceptance can still require monitoring and review. Transfer does not make every consequence or accountability disappear. Record the reasoning, decision owner and expected residual exposure.

Maintain comparability

Use the approved criteria consistently and review them when the business context changes. When a scale changes, identify which existing assessments need reconsideration. Do not assume that old and new ratings are directly comparable solely because their labels look similar.