Risk Evaluation and Prioritization
Domain 4 tests the judgment step after analysis: deciding which risks matter and in what order to act. Expect questions on appetite comparison, risk ranking, velocity, and aggregation.
Core rules
- Evaluation compares analyzed risk with risk criteria: appetite, tolerance, legal limits, and strategic objectives.
- Prioritization is not the same as sorting a risk score; consider velocity (how fast impact arrives), persistence, dependencies, and regulatory exposure.
- Risk aggregation matters: many medium risks in one process can exceed appetite even when each is individually acceptable.
- A heat map is a communication aid, not a decision rule; color bands must be defined and calibrated.
- Documented rationale is required when accepting a high risk or overriding a score.
Worked example
Two risks both score 16 on a 5×5 matrix. Risk A is a slow-building reputational issue with a 12-month horizon. Risk B is a payment outage that could occur during peak season and exceed the $1 million tolerance in four hours. The team prioritizes B first because its velocity and proximity to a hard tolerance breach are higher, even though the score is equal. The reasoning shows that score equality does not imply equal urgency; time-to-impact and threshold proximity change the order.
Traps
- Treating the highest score as the only priority and missing fast-moving risks.
- Inflating scores to get funding, which destroys calibration.
- Ignoring aggregated exposure across business units.
- Using red, amber, and green without written thresholds.