Ranking Two Risks That Tie on the Heat Map
A regional credit union maintains a 5x5 likelihood-impact register. At the quarterly review, two risks compete for the single funded remediation slot. R-14 is ransomware encrypting the shared file estate: likelihood 4, impact 4, score 16, affecting roughly 400 staff and 60,000 members' statements. R-22 is a single administrator holding unchecked control over the payment gateway, with no peer review and no session recording: likelihood 5, impact 3, score 15. The CISO wants R-14 funded because 16 beats 15. A third entry, R-31, scored only 6, records that marketing sends promotional email to members who have opted out - a clear breach of consent rules with a defined regulatory penalty. The audit committee chair asks why a score-6 item appears on the top-ten list.
1. Which risk should get the funded slot, and on what basis?
Read the worked answer
Score order alone is the weakest possible tie-breaker; use the shape of the risk, not its label.
R-22 first. Confidence in the estimate matters. R-22's likelihood of 5 rests on an observable, verifiable fact: one person, no review, no session recording. The exposure is continuous and the control gap is provable. R-14's 4x4 depends on threat-intelligence assumptions and on controls that may or may not be effective - it is a plausible estimate, not a measured one.
Velocity and duration also favour R-22: a rogue administrator action can be instantaneous and silent, while ransomware at least generates detectable encryption activity.
But the correct answer is not "ignore R-14." It is: fund the cheap, high-confidence fix for R-22 (peer review plus session recording is typically a configuration and process change, not a programme), and route R-14 into a multi-quarter treatment plan with segmentation and tested backups. The decision is sequencing and cost-to-fix, not a contest between two integers.
2. What are the weaknesses of the 5x5 scoring approach here?
Read the worked answer
- Ordinal scores are not arithmetic. 4x4 is not meaningfully larger than 5x3; multiplying ranks produces a number that resembles a measurement but is not one. Treating 16 > 15 as decisive is a category error.
- Range compression. Everything interesting crowds into 9–16, so small scoring differences look significant when they are within assessor noise.
- No velocity, no control confidence, no cost-to-fix. Three dimensions that drive real prioritization are absent from the grid.
- Anchoring and drift. Repeated quarterly scoring tends to converge on familiar numbers; assessors score against last quarter rather than against evidence.
- Hides low-score/high-certainty items. A regulatory breach with a known penalty does not need a high likelihood to demand action.
Fix: keep the matrix for communication, but carry velocity, control confidence, and estimated remediation cost as explicit columns, and treat scores as starting points for discussion rather than a ranking algorithm.
3. How should R-31, the consent breach, be handled?
Read the worked answer
R-31 is misclassified, not mis-scored.
The likelihood may be low (marketing sends rarely) and the impact may look modest on a generic scale, but the exposure includes a defined regulatory penalty and a compliance obligation the credit union cannot choose to carry. That is a compliance risk with a binary threshold: either the consent check exists in the campaign workflow or it does not.
Treatment: move it out of the general heat-map ranking into a compliance obligations view where the question is "are we in breach?" rather than "how bad might this be?" Add a preventive control - an automated suppression check before any campaign send - and a detective control - monthly reconciliation of sent lists against the opt-out register. Then report it to the audit committee as a compliance status item with a pass/fail, explaining that a score-6 entry can outrank a score-16 entry when the exposure is a known rule breach rather than an uncertain event. That is the distinction the chair is really asking about.