- Date:
- 23 Mar 2026
About this guide
Risk criteria are the clear benchmarks used to assess and prioritise risks.
When you’re assessing risks, you’ll need to refer to your organisation’s risk criteria to help you decide on how to treat them.
We’ve put together these examples to help you review and refine your own organisation’s risk criteria. You’ll find guidance on:
- Consequence descriptors
- Likelihood descriptors
- Risk rating
- Escalation and response for risk rating.
Consequence descriptors
A consequence descriptor in risk assessment is a clear description – either qualitative or quantitative – that defines how severe the impact would be if a specific risk event happens.
It provides a standardised definition for each level of a consequence scale (e.g. Severe, Major, Moderate, Minor and Insignificant) to guide consistent ratings and level of response.
Here are some examples of consequence descriptors.
When you’re assessing risk in your organisation, make sure you use your own descriptors—they should reflect your unique context and needs.
Likelihood descriptors
A likelihood descriptor in risk assessment is a qualitative or quantitative term for describing the probability, frequency, or chance of a specific risk event or consequence occurring within a defined timeframe. To help prioritise different risks, likelihood descriptors are assigned to a ranking scale in a risk matrix.
Here are some examples of likelihood descriptors.
These use a controls-centric approach – that assumes most significant risks are within your control.
Likelihood | Descriptor example |
| Almost certain | All controls associated with the risk are weak and/or non-existent. Without control improvement there’s almost no doubt that the event and its consequences will eventuate. |
| Likely | Most controls associated with the risk are weak. Without control improvement, it’s more likely than not that the event and its consequences will eventuate. |
| Possible | There are some controls that need improvement. If there’s no improvement, there’s a good chance the event and its consequences will occur. |
| Unlikely | Most controls are strong with few known control gaps. If this risk eventuates, it’s most likely because of external circumstances outside of our control. |
| Rare | All controls are strong with no known control gaps. If this risk eventuates, it’s most likely because of external circumstances outside of our control. |
Risk rating matrix - example
The matrix combines the consequence and likelihood ratings to plot risks at differing levels of severity. It's an easy way to visualise the risks which require different levels of response. Over time, its also possible to see plot movement on the matrix as risks become more or less severe.
The matrix is typically used in reporting to different audiences: executives, operational teams, committees, Boards, regulators, etc.
Escalation and response - examples
When assessing risks, a key step is evaluation. Evaluation is the process of comparing analysed risks against established criteria to determine their tolerability, significance, and priority. It involves deciding whether a risk is acceptable or requires treatment by weighing its likelihood and consequences to directly guide the urgency of review, the appropriate level of oversight, and, ultimately, decisions about control.
Here are some examples of escalation and response.
When you’re assessing risk in your organisation, make sure you use your Risk Management Policy and/or delegations of authority.
Sources
The examples provided were adapted from several sources including:
Updated