Skip to main content
Clause 3.3 requires each risk to carry a RAG categorisation, or something similar. guardbook derives it from the scores you enter rather than asking you to set it separately.

​
How the score is calculated

Score = likelihood × impact. Each is 1 to 5, so a score runs from 1 to 25. Every risk has two: an inherent score, before your controls, and a residual score, after them.

​
The bands

These bands are fixed and are not configurable per firm. They apply the same way on screen and in the evidence pack, so a risk that is Amber in guardbook is Amber in the document you hand an assessor.
If likelihood or impact is blank, that score has no band. The register shows a dash and the risk page shows Not yet assessed, because an unassessed risk is not the same as a low one. Without a residual score there is no appetite check either. If your register is full of dashes, it is not yet doing its job.

​
Risk appetite

Your firm’s owner chooses a risk appetite in the setup survey: Averse, Minimalist, Cautious, Open or Ambitious. guardbook turns that into a maximum residual score: Averse 5, Minimalist 10, Cautious 13, Open 19, Ambitious 25. A risk is within appetite if its residual score is at or below that number. guardbook shows the answer in the Within appetite column: Yes, No, or a dash if either the appetite or the score is missing. Only the owner can change the choice, from Organisation, then Survey answers. With Ambitious, no risk can ever show as above appetite. Open a risk and the same answer appears as a badge next to the title, reading Within appetite or Exceeds appetite. The evidence pack states your appetite category once, at the top of the risk register section, rather than a result for each risk. Choose your appetite deliberately. It sets the line at which your firm stops accepting a risk and starts doing something about it. An assessor may ask why you chose it.
Nothing in guardbook blocks a risk that exceeds appetite. The comparison is a flag, not a control.A Red risk sitting above your appetite with a status of Open and no action against it is exactly what a reviewer will pick out first. That is the flag doing its job, so act on it.

​
A note on appetite categories

You will see AI risk appetite described elsewhere using five categories: averse, minimalist, cautious, open and ambitious. The RICS glossary mentions those categories, but it introduces them with the word “generally”. It is describing common practice, not mandating a five-way split. guardbook asks you to choose one of these five, because they are the usual ones. It then uses a number behind each category to flag each risk as within or above appetite.