Assessing likelihood and impact

1. Regulatory Concept & Core Standards

This video's topic is assessing likelihood and impact. By the end, you should be able to assign risk levels using consistent, reasoned criteria. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. A matrix organises possible events and suitable controls. The scales and methods in this course are organisational examples, not a single statutory method for every company. The Ministry of Finance management-control standards apply within their public-sector scope.

Likelihood and impact help grade risks. Define levels to avoid purely intuitive assessments. Impact may include financial, legal, operational and trust consequences. Distinguish risk before controls from risk after considering effective controls. A merely planned measure must not reduce the current assessment.

Apply the following rule: Portuguese RGPC is not Polish law. For public-finance entities consider management-control requirements; for public procurement consider the applicable Pzp provisions. The risk matrix, audit, training and gifts-policy methods in these courses are organisational recommendations unless a specified provision imposes a duty on the particular entity. Public-administration duties must not be transferred automatically to every private company.

2. Practical Implementation & Procedure

Adopt an understandable scale and explain criteria. This exercise uses three levels only as an example. Examine exposure, opportunities and existing controls. Record reasons and uncertainties. Compare similar processes. No known incidents does not mean zero likelihood, particularly where detection is weak. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Two departments rate a risk low. One has independent review, while the other has no control and relies on receiving no reports. Common criteria reveal the difference. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Is an absence of reports sufficient to reduce the rating? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. It can reflect weak detection or trust. Assess the process, opportunity for misconduct and actual control performance.

One mistake to avoid is: assigning numbers without criteria or presenting the teaching matrix as a legal requirement.

Now apply the national rule to a second decision. The team presents all integrity tools as mandatory in every country. How should the explanation change?

Separate Polish legal duties, their conditions and recommended practice. Management-control standards address the relevant public sector. A private risk or gifts policy needs a purpose and owner, but does not become an obligation under Portuguese RGPC. Every claim of a duty requires a specific basis.