Inherent risk heatmap
Your risks, before controls. Ranked honestly.
01 · How it works
Three steps. One honest picture.
01 · Register
Your current register
Whether you keep a risk register, and how much risk your board will accept.
02 · Exposure
Likelihood and impact
One question per category: tick what applies. Each answer carries a fixed likelihood and impact, so nothing rests on a guess.
03 · Result
Your heatmap
See your exposure score, alert level, heatmap and ranked register straight away. Share your details for a PDF report with where to act first.
About 5 minutes. Your answers stay in your browser unless you request the full report.
Indicative.
Inherent risk, before controls.
Indicative self-assessment of inherent risk (before controls), based on your answers. It is not a risk assessment, an audit or professional advice. Each option you tick carries a fixed likelihood and impact rating; a category's rating is their average, but never more than one level below the worst. Regulatory impact is the higher of that and your open demands as a share of net worth. Risk score is likelihood x impact (1 to 25): 15 and above critical, 10 to 14.9 high, 5 to 9.9 medium, below 5 low. The exposure score weights each risk by its own score.
Spotted an error: connect@dissent.one.
Questions
Straight answers.
- What does the inherent risk heatmap measure?
- It asks eleven questions across eight categories: strategic, financial reporting, regulatory tax and transfer pricing, reputation, fraud, cyber, operations and supply chain, and people. Every option carries a fixed likelihood and impact, rated before controls. The result is a five-by-five heatmap, a ranked register, and an exposure score from 0 to 100.
- What is the difference between inherent and residual risk?
- Inherent risk is the exposure before controls. Residual risk is what remains after the controls you already run. This tool scores inherent risk only. A full risk assessment tests whether those controls actually bring the rating down.
- How is the exposure score calculated?
- A category's likelihood and impact are the average of the options you tick, but never more than one level below the worst. Risk score is likelihood times impact, from 1 to 25: 15 and above is critical, 10 to 14.9 high, 5 to 9.9 medium, and below 5 low. The exposure score weights those risks from 0 to 100. One risk scoring 20 or more forces an alert on its own.
- Does this replace a risk assessment?
- No. It is an indicative self-assessment for the board or audit committee. It is not a risk assessment, an audit, or professional advice.
Pressure-test your register.
Before the board does.
Thirty minutes on your top risks, the controls that should be bringing them down, and where internal audit should look first.
Dissent Audits →