RMM Inherent Control Risk Model Lookup

Read a caller-supplied five-by-five likelihood-impact matrix and classify the selected inherent-risk score using explicit percentage thresholds.

Description

A likelihood-impact matrix is an explicitly chosen risk model.

A likelihood-impact matrix is an explicitly chosen risk model. Scores and band boundaries are supplied rather than inferred from inherent/control risk evidence.^[1]

The returned values include Risk classification, Risk score. The How section below explains the calculation, input rules and interpretation.

When to use RMM Inherent Control Risk Model Lookup

Use RMM Inherent Control Risk Model Lookup when you need to evaluate the supplied records under the calculation and evidence rules below. No control-risk multiplier or risk of material misstatement probability is calculated. Band thresholds are caller supplied and equality advances to the next band.

Prepare source-backed observations and the applicable engagement policy before entering facts. Use consistent monetary units and periods. Supply all boolean evidence flags explicitly, and treat a successful screen as a reason to continue professional review.

How to use RMM Inherent Control Risk Model Lookup and understand its results

Prepare source-backed observations and the applicable engagement policy before entering facts. Use consistent monetary units and periods. Supply all boolean evidence flags explicitly, and treat a successful screen as a reason to continue professional review.
Enter impact, likelihood, lowUpperPercent, moderateUpperPercent, riskMatrix using the field table and calculation rules, then run the tool.
Read classification, riskScorePercent. The explanation below defines the units, signs, ordering and any flags or placeholder values.
If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.

Input field	Meaning	Value type; see rules below	Requirement
impact	Impact rating	integer; minimum: 1; maximum: 5	Required
likelihood	Likelihood rating	integer; minimum: 1; maximum: 5	Required
lowUpperPercent	Low-risk upper threshold	number; minimum: 0; maximum: 100	Required
moderateUpperPercent	Moderate-risk upper threshold	number; minimum: 0; maximum: 100	Required
riskMatrix	Five rows and five columns of risk scores from 0 through 100.	list of list of number	Required

Require axis safe integers 1–5, an exact5×5 finite 0–100 matrix and thresholds 0–100 with low<moderate. Score<low gives low, <moderate moderate, score 100 critical, otherwise high. Equality advances to the next band.

score=matrix[likelihood−1][impact−1]

Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.

Output field	Meaning	Value type
classification	Risk classification	string; one of "critical", "high", "low", "moderate"
riskScorePercent	Risk score (percent)	number; minimum: 0; maximum: 100

json

{
  "input": {
    "impact": 5,
    "likelihood": 5,
    "moderateUpperPercent": 50,
    "lowUpperPercent": 20,
    "riskMatrix": [
      [
        5,
        10,
        20,
        30,
        40
      ],
      [
        10,
        20,
        30,
        40,
        50
      ],
      [
        20,
        30,
        40,
        60,
        70
      ],
      [
        30,
        40,
        60,
        80,
        90
      ],
      [
        40,
        50,
        70,
        90,
        100
      ]
    ]
  },
  "output": {
    "classification": "critical",
    "riskScorePercent": 100
  }
}

Limitations and assumptions

No control-risk multiplier or risk of material misstatement probability is calculated. Band thresholds are caller supplied and equality advances to the next band.

Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Core numeric and string lists are limited to 100,000 entries; text entries are subject to the general large-text limit. Follow any smaller calculation limits above. Matrices are limited to 128 rows and 128 entries per row. Missing fields without a declared default, extra fields, wrong value types and violations of the calculation rules are input errors.

Alternative or Complementary methods

Use Significant Risk Fraud Factor Flag Checker: Fraud-risk factors can identify a need for further assessment. This screen also requires an entered financial-statement misstatement risk. For a complementary task, use Evidence Relevance Reliability Two-Axis Lookup: Evidence relevance and reliability describe different dimensions. This implementation combines their entered ratings by addition.

References

RMM Inherent Control Risk Model Lookup — tool.io

Similar or alternative tools

Significant Risk Fraud Factor Flag Checker
Fraud-risk factors can identify a need for further assessment. This screen also requires an entered financial-statement misstatement risk.
Evidence Relevance Reliability Two-Axis Lookup
Evidence relevance and reliability describe different dimensions. This implementation combines their entered ratings by addition.