1m Risk Rating Guide

Impact 
Catastrophic: Catastrophic disruption to operations or services evidenced by: imminent risk of severe physical harm or financial loss; care being indefinitely inaccessible to patients and/or members; failure of areas vital to the survival of the organization; catastrophic operational deficiencies and staffing challenges; intense scrutiny by regulatory agencies; and/or irreversible damage to reputation or regulatory standing. For financial risks: bottom-line annual financial impact of this risk would be equivalent in magnitude to >5.0% of revenue.  
Critical: Critical disruption to operations or services evidenced by: risk of great physical harm or financial loss; care being inaccessible or significantly delayed to patients and/or members; failure of areas of major significance to the organization; severe operational deficiencies; significant scrutiny by regulatory agencies; and/or loss of contract or accreditation. For financial risks: bottom-line annual financial impact of this risk would be equivalent in magnitude to 3.0-5.0% of revenue. 
Major: Major disruption to operations or services evidenced by: risk of major physical harm or financial loss; care being partially inaccessible or delayed to patients and/or members; dysfunction of areas of major significance to the organization; significant operational deficiencies; and/or major scrutiny by regulatory agencies. For financial risks: bottom-line annual financial impact of this risk would be equivalent in magnitude to 1.0–3.0% of revenue.  
Moderate: Noticeable but manageable disruption to operations or services evidenced by: risk of moderate physical harm or financial loss; care being minimally inaccessible or delayed to patients and/or members; impacts to areas of moderate significance to the organization; modest operational deficiencies; and/or some scrutiny by regulatory agencies. For financial risks: bottom-line annual financial impact of this risk would be equivalent in magnitude to 0.5–1.0% of revenue.  
Minor: Minimal disruption to operations or services evidenced by: risk of minor physical harm or financial loss; no changes to patient and/or member care; impacts to areas of limited significance to the organization; limited operational deficiencies; and/or minimal scrutiny by regulatory agencies. For financial risks: bottom-line annual financial impact of this risk would be equivalent in magnitude to 0.1–0.5% of revenue.  
Minimal: No significant impact on operations or services. For financial risks: bottom-line annual financial impact of this risk would be equivalent in magnitude to <0.1% of revenue. 



Likelihood 
Almost Certain: Approximately 75% chance of occurring in the next 10 years. 
Likely: Approximately 50% chance of occurring in the next 10 years. 
Moderate: Approximately 25% chance of occurring in the next 10 years. 
Unlikely: Approximately 10% chance of occurring in the next 10 years. 
Remote: Approximately 1% chance of occurring in the next 10 years. 
 

Imminence 
Imminent: Likely to occur very soon. 
Neutral: Neither imminent nor remote; no strong indications about timing. 
Remote: Unlikely to occur in the near future. 
 

Onset 
Multi-Year: The organization would be aware that this risk is going to occur several years in advance. 
One Year or Less: The organization would be aware that this risk is going to occur one year or less in advance. 
Immediate: The organization would not be aware that this risk is going to occur before it happens. 
 

Permanence 
Indefinite: Effects last for an unlimited amount of time. 
Multi-Year: Effects last for multiple years. 
One Year or Less: Effects last for one year or less.