The two contributing factors are likelihood and impact. A possible approach would be that likelihood be scored 1-5 from very unlikely, unlikely, possible, likely, and highly likely, respectively. Impact can similarly be scored 1-5 depending on the severity should the adverse event occur, from ‘insignificant’ (nothing to worry about), ‘fairly serious’ and ‘serious’ (a threat which could cause reasonable problems and would definitely take up time and resources) up to ‘very serious’ and ‘major disaster’ (could seriously undermine the standing and position of the organisation). By multiplying these together, risks will have a score from 1-25 depending on their severity.

Want to discuss further?