Risk Register Scoring: Likelihood, Impact, Inherent and Residual Risk With Example Rows

A risk register is only as useful as its scoring. Scales that nobody defines produce ranked lists that cannot be defended to an audit committee. This post sets out a scoring method consistent with the IIA Global Internal Audit Standards and the SEC's guidance on evaluating risk of misstatement, with example rows you can copy.

What the standards say about scoring

Standard 14.3 says that to determine the significance of a risk, internal auditors consider the likelihood of the risk occurring and the impact it may have on governance, risk management or control processes. Its implementation text adds that to determine the significance of a finding, auditors identify and evaluate existing controls for design adequacy and effectiveness and then determine the residual risk, described there as the risk that remains despite having controls in place. Standard 13.2 requires auditors planning an engagement to evaluate the significance of identified risks and prioritize them, and to consider fraud risks specifically. Standard 9.4 requires the annual risk assessment to be documented and informed by the board and senior management.

For financial reporting, the SEC's interpretive guidance lists risk factors that bear on whether a control deficiency creates a reasonable possibility of misstatement, and they translate well to register scoring: the nature of the financial reporting elements involved (suspense accounts and related party transactions involve greater risk), susceptibility of the asset or liability to loss or fraud, subjectivity, complexity or judgment needed to determine the amount, interaction with other controls, and possible future consequences. A footnote adds that the evaluation can be made without quantifying the probability of occurrence as a specific percentage or range.

Define the scales first

Write definitions into the register so scorers apply the same meaning.

Impact (1 to 5). Tie levels to the organization's own thresholds.

Use the company's actual materiality figures from the external auditor or management.

Likelihood (1 to 5).

Likelihood definitions use frequency of occurrence. The SEC guidance accepts a judgment made without a specific percentage.

Score inherent, then residual

1. Inherent score = likelihood x impact, ignoring controls.
2. Identify the controls and rate their design (does it address the risk if it operates?) and operation (does evidence show it did?). Standard 14.3's implementation text calls for evaluating both design adequacy and effectiveness.
3. Residual score = likelihood x impact after controls. A strong, tested preventive control reduces likelihood. A detective control with a long lag may reduce impact only.
4. Document the basis in one line. A score of 4 with no reason cannot be challenged or defended.

Do not reduce a score for a control that is untested. A control that exists on paper reduces residual risk only to the extent evidence supports it.

Example rows

Rows R-01, R-03 and R-05 show the rule: untested, failed or not-yet-performed controls leave residual equal to inherent. Row R-02 shows a preventive control lowering likelihood. Row R-04 shows the same, with a detective review adding assurance.

Using the register

The register feeds three decisions.

• The annual plan. Rank by residual score, then by time since last audit. Standard 9.4's implementation text lists significance of risk, theme or trend, regulatory requirement and time since the last engagement as reasons for selecting engagements. See /us/blog/internal-audit-plan-standard-9-4-annual-risk-assessment-and-board-approval.
• Engagement scope. High residual risks drive the work program, which Standard 13.6 requires to be based on the engagement risk assessment (Standard 13.2).
• Evidence for ICFR. The SEC guidance says management tailors its evaluation procedures to the risk of misstatement of each financial reporting element and the risk of control failure, and that evidence needed rises with that risk. The register is the document where that evaluation lives. See /us/blog/control-testing-evidence-by-risk-direct-tests-versus-ongoing-monitoring.

Mistakes to avoid

• Averaging. Averaging likelihood and impact scores across risks hides the high-impact, low-likelihood items that boards care about. Rank by the product but also list any impact-5 item separately.
• Scoring controls at design only. A designed control that fails in testing does not reduce risk.
• Static registers. Standard 9.4 requires the plan to be updated timely when the business, risks, systems or controls change.
• Copying management's register. Standard 9.4's implementation text says the function should independently review and validate the key risks identified in the risk management system, and rely on management's information only if it concludes the risk management processes are effective.

For the risk and control matrix that links risks to specific controls, see /us/blog/risk-and-control-matrix-guide.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 9.4, 13.2, 13.6, 14.3: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• SEC, Release No. 33-8810, Sections II.A.2.a (evidence based on ICFR risk) and II.B.1, Evaluation of Control Deficiencies (risk factors and footnote 48 on quantification of probability): https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error