Risk Criticality and Confidence Scoring Automation: Severity and Trust Are Never the Same Number

A simple probability-times-impact score treats every risk with the same numeric product identically, even though a slow-moving, easily detected risk with plenty of warning time behaves nothing like a sudden, invisible one with the same nominal score — a team can prepare for the first and gets blindsided by the second. And a second, separate problem hides inside any single risk score: a risk can look genuinely severe on paper while resting on almost no real evidence, or look mild while being backed by solid data — conflating "how bad" with "how sure" produces a number that looks precise and is not defensible under questioning.

A single multiplied score is easy to compute and easy to sort by, which makes it the default even though it cannot represent a genuinely asymmetric case — a moderate risk moving immediately can deserve more attention than a severe one moving slowly, and a multiplication has no way to say that. And a control tends to get credited the moment it is written down in a policy, because verifying that a control actually works in practice takes ongoing effort that a static document never forces anyone to repeat.

Inherent criticality — calculated BEFORE any controls are considered, deliberately, so a control can never quietly lower the starting point — comes from seven weighted criteria: probability and impact (weight 3 each), materialization speed, detectability and reversibility (weight 2 each), and degree of control plus how many other records depend on this risk (weight 1 each), combined into a single weighted percentage and mapped to one of five levels from low to extreme. On top of that weighted score, a set of hard floors can only ever raise the final level, never lower it, each recording its own explicit reason: existential impact floors at "critical," a critical impact combined with at least moderate probability floors at "high," an irreversible effect combined with high-or-greater impact floors at "high," an imminent probability combined with moderate-or-greater impact floors at "high," immediate materialization speed combined with zero advance detectability floors at "high," high-or-greater impact in one of five specific dimensions that never dilute by averaging (privacy, security, legal, data, continuity) floors at "high," and exposure declared outside a stated tolerance policy floors at "high." Only after inherent criticality is set does a documented control get evaluated: a control counts only if it is currently active, has actually been verified (not merely written down), and that verification is no older than 180 days — a stale verification is treated as no verification at all. Verified, effective controls can reduce the residual reading by at most ONE level, no matter how many controls exist or how effective they individually are — this methodology scores residual exposure, never risk elimination. A completely separate confidence score, built from seven different weighted criteria (declared probability basis, linked evidence, anticipatory signals, tracked indicators with actual readings, assessed impact dimensions, a confirmed owner, and a scheduled review), answers "how much should this specific assessment be trusted" rather than "how bad is it" — and it carries its own hard caps: zero evidence, zero signals and zero declared basis together cap confidence at the very lowest level regardless of every other criterion, zero evidence alone caps it at "moderate" even if every other number would compute higher, and the very top rating requires a human to have actually promoted the risk, not just a favorable score. A response evaluation separately flags "monitor" as the sole strategy on a high-or-greater risk, an irreversible or immediately-materializing risk with no contingency plan, and "accept" chosen for a severe risk without a recorded approver. And when no organizational tolerance policy is on file — the common case — the tool states plainly that tolerance is undefined rather than assuming the exposure is acceptable by default.

Two risks are logged for the same client in the same week. The first — a slow, gradual decline in a key supplier's service quality, moderate probability, moderate impact, easily detectable through routine check-ins — computes to a "moderate" criticality with no floor applied. The second — a possible sudden regulatory change affecting the client's core offering, also rated moderate probability and moderate impact on paper, but with immediate materialization speed and a "somente_apos_impacto" (only perceptible after the fact) detectability rating — trips the immediate-velocity-plus-undetectable floor and is elevated to "high" specifically because there is no warning window to react in, even though the raw probability and impact ratings started out identical to the first risk. A documented mitigation control exists for the second risk, but it was never actually verified — the residual reading stays at "high," unchanged from the inherent one, because an unverified control counts as no control at all.

A fast, hard-to-detect risk gets the elevated attention a slow, easy-to-watch one with the same nominal probability and impact does not automatically deserve — because the score accounts for speed and detectability directly, not just probability and impact averaged together. A control someone wrote into a policy stops counting for anything until it is actually verified to work, and that verification has an expiration built in. And a severity number and a confidence number are never collapsed into one figure that hides which of the two — "how bad" or "how sure" — is actually driving the reading a client is being shown.

An organization that wants a simple, single-number risk heat map with no distinction between severity and confidence, and no interest in verifying whether documented controls actually work, will find this scoring model more rigorous than it needs — it is built for a consulting practice defending its risk reads to a client's leadership, not a lightweight internal checklist.

A simple multiplication collapses speed, detectability, reversibility, control verification, and confidence into one number that cannot represent any of them individually. Centriu Oracle instead computes a weighted, floor-protected criticality score, evaluates control effectiveness only after independent verification, caps residual reduction at one level regardless of control count, and keeps a fully separate confidence score — so a client always sees not just how bad a risk is rated, but how much that specific rating should actually be trusted.