> ## Documentation Index
> Fetch the complete documentation index at: https://help.guardbook.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# RAG ratings and risk appetite in guardbook

> How guardbook scores a risk, where the Green, Amber and Red bands sit, and how your firm's risk appetite works.

Clause 3.3 requires each risk to carry a RAG categorisation, or something similar. guardbook derives it from the scores you enter rather than asking you to set it separately.

## How the score is calculated

**Score = likelihood × impact.** Each is 1 to 5, so a score runs from 1 to 25.

Every risk has two: an **inherent** score, before your controls, and a **residual** score, after them.

## The bands

| Band | Score |
| - | - |
| **Green** | 1 to 6 |
| **Amber** | 7 to 12 |
| **Red** | 13 to 25 |

These bands are fixed and are not configurable per firm. They apply the same way on screen and in the evidence pack, so a risk that is Amber in guardbook is Amber in the document you hand an assessor.

> [!NOTE]
>
> If likelihood or impact is blank, that score has no band. The register shows a dash and the risk page shows Not yet assessed, because an unassessed risk is not the same as a low one. Without a residual score there is no appetite check either. If your register is full of dashes, it is not yet doing its job.

## Risk appetite

Your firm's owner chooses a **risk appetite** in the setup survey: Averse, Minimalist, Cautious, Open or Ambitious. guardbook turns that into a maximum residual score: Averse 5, Minimalist 10, Cautious 13, Open 19, Ambitious 25. A risk is within appetite if its **residual** score is at or below that number. guardbook shows the answer in the **Within appetite** column: Yes, No, or a dash if either the appetite or the score is missing.

Only the owner can change the choice, from **Organisation**, then **Survey answers**. With Ambitious, no risk can ever show as above appetite.

Open a risk and the same answer appears as a badge next to the title, reading **Within appetite** or **Exceeds appetite**. The evidence pack states your appetite category once, at the top of the risk register section, rather than a result for each risk.

Choose your appetite deliberately. It sets the line at which your firm stops accepting a risk and starts doing something about it. An assessor may ask why you chose it.

> [!WARNING]
>
> Nothing in guardbook blocks a risk that exceeds appetite. The comparison is a flag, not a control.
>
> A Red risk sitting above your appetite with a status of Open and no action against it is exactly what a reviewer will pick out first. That is the flag doing its job, so act on it.

## A note on appetite categories

You will see AI risk appetite described elsewhere using five categories: averse, minimalist, cautious, open and ambitious.

The RICS glossary mentions those categories, but it introduces them with the word "generally". It is describing common practice, not mandating a five-way split. guardbook asks you to choose one of these five, because they are the usual ones. It then uses a number behind each category to flag each risk as within or above appetite.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.