What it means
Likelihood and impact are core dimensions used to analyze risk. Likelihood considers threat capability, intent, opportunity, exposure, control effectiveness, historical evidence, and uncertainty. Impact considers effects on operations, finances, safety, legal obligations, customers, reputation, and strategic objectives.
How it works
Organizations may use descriptive scales, numeric ranges, scenarios, distributions, or monetary estimates. The method should be consistent enough to support decisions without pretending uncertain inputs are exact. Inherent risk is considered before selected controls; residual risk reflects the expected condition after controls.
Credential theft may be highly likely for a public-facing organization, but the impact varies. Theft of a low-privilege training account differs from theft of an identity administrator account with access to production and recovery systems.
Practical focus
- Define rating scales and evidence expectations
- Assess specific scenarios rather than vague categories
- Separate likelihood from impact before combining them
- Record uncertainty and assumptions alongside the result
Common mistakes
- Using impact as a substitute for likelihood
- Multiplying ordinal labels as though they were precise measurements
- Ignoring control failure and changing exposure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: