Assessing likelihood and impact

1. Regulatory Concept & Core Standards

This video's topic is assessing likelihood and impact. By the end, you should be able to use a scoring scale to support reasoned assessment. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. A risk matrix is a recommended management tool linking process, potential breach, control and owner. A score is not an official legal decision. National duties must be tied to an Estonian source and the entity’s status, rather than a Portuguese RGPC template.

An internal scale supports comparison but is neither an exact prediction nor legal classification. Impact may involve money, safety and trust. Assess real controls and uncertainty. High risk does not establish a past breach.

Apply the following rule: Section 13 requires reasonable grounds at reporting to believe that a breach has directly begun or been completed and falls within scope. Do not automatically extend this to every hypothetical future concern. KVS primarily addresses public functions and contains specific corruption-reporting provisions. Portuguese RGPC is not Estonian law. Risk matrices, internal plans and teaching methods are recommendations unless a specific legal duty is identified.

2. Practical Implementation & Procedure

Define scale meanings beforehand. Justify likelihood and impact using evidence. Separate inherent and residual exposure and identify assessor and uncertainty. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Two departments score the same risk differently because high means different things. The team agrees definitions and reassesses. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does using the highest number produce the most accurate assessment? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Accuracy depends on shared criteria and reasons. Numerical precision can conceal missing evidence and inconsistent assumptions.

One mistake to avoid is: treating a score as an objective fact.

Now apply the national rule to a second decision. The team presents every integrity instrument as mandatory in every country. How should it correct the claim?

Separate actual Estonian duties, their scope and recommended management methods. KVS public-function duties do not automatically apply to every private company. Each duty needs a source, while each internal choice needs a purpose, owner and evidence. Portuguese RGPC does not replace Estonian law.