Scoring, treatment and appetite

Every scenario is scored twice, on likelihood and impact.

• Inherent — how bad it would be with none of your controls in place.
• Residual — how bad it is given what you actually have.

Score inherent first and honestly. The temptation is to score it low because you have controls; that is what residual is for, and doing it in the wrong place hides the value of the controls you are paying for.

The two heatmaps side by side: the same scenarios plotted before and after your controls.

The scales are yours

Settings → Risk carries the likelihood and impact scale labels, the risk categories and the approval workflow. Set the labels to the ones your risk policy already uses before anyone scores anything — rescoring a register because the words changed is nobody’s good afternoon.

Changing the calculation changes what past decisions meant

If approved appetite statements measure a limit against residual score, changing the scoring calculation moves the scale that limit sits on. Vendorica tells you how many statements are affected and returns them to draft for re-approval rather than silently redefining a board decision. That warning is not a formality — read it.

The four treatments

Every scenario takes one:

Treatment	What it means
Mitigate	Do something to reduce it. Needs a plan.
Accept	Live with it, knowingly and on the record.
Transfer	Move it — insurance, a contractual term.
Avoid	Stop doing the thing that creates it.

Mitigate asks for a treatment plan: concrete actions, owners, timelines, and a target resolution date. “Improve monitoring” is not a plan. Accept is a perfectly respectable answer and often the right one — the difference between accepting a risk and ignoring it is that the first is written down, dated and approved.

Approval

Where your organization has enabled it, a scenario goes through an approval workflow: Submit for approval, then approved or rejected with a reason. That is how a residual score stops being one person’s opinion and becomes the organization’s position.

Appetite

Risk → Appetite states how much risk of each kind the organization has agreed to carry, and shows where you currently sit against it. Each statement sets a tolerance limit — for a category, against a metric such as average or worst residual score.

This is the page written for a board rather than a practitioner, and it is the one that makes the register consequential: without a stated line, a rising number is an observation, and nobody has to do anything about an observation.

Indicators keep it current

Risk → Indicators holds key risk indicators — measured numbers with amber and red thresholds, on a cadence, sourced by hand or from automated test results. A crossed threshold raises a review task; it never silently changes a rating. A number that moves a risk score without a human deciding is a number nobody trusts by the second quarter.

Proving it moved

Risk → Snapshots freezes the register on a date. Two snapshots and a trend chart answer “is this getting better”, which is the only risk question a board actually asks.