Risk Rating
Definition
A classification of a finding's severity, typically Critical, High, Medium, Low, or Informational, derived from a likelihood-by-impact matrix. The rating determines remediation priority and timeline. It must be justified in the finding, not merely asserted.
- Typical scale
- Critical, High, Medium, Low, Informational
- Derived from
- A likelihood-by-impact matrix
- Governs
- Remediation priority and timeline
- Requirement
- Must be justified in the finding narrative, not asserted alone
Common questions
Why can two auditors disagree on the rating for the same finding?+
Likelihood and impact are judgement calls influenced by compensating controls, data sensitivity, and threat context, so ratings vary unless the audit methodology fixes clear scoring criteria for each factor.
What happens if a rating is not justified in the report?+
An unjustified rating is difficult for the client to prioritise against other findings and is often challenged during report review, which can delay remediation planning.
Does a Critical rating always mean immediate exploitation is possible?+
Not necessarily. Critical usually reflects severe potential impact combined with a realistic exploitation path, but the matrix weighting varies between organisations, so the same technical flaw can rate differently across audits.
Related terms
- Executive Summary
- The opening section of an audit report written for non-technical leadership. It states the audit scope, overall posture, the most material findings...
- Finding
- A discrete, evidence-backed statement that a specific control is absent, misconfigured, or insufficient. Each finding contains an issue statement, evidence, risk rating,...
- Management Response
- The audited organisation's formal reply to each finding, included in the report. It states whether the recommendation is accepted, rejected, or accepted...
- Nonconformity
- The ISO 27001 term for a finding that represents a failure to meet a requirement of the standard or the organisation's own...
- Observation
- A noted issue or improvement opportunity that does not constitute a formal finding because it lacks sufficient evidence or does not violate...