Use this before the first register, or when two people score the same risk three points apart. You get two documents in a new folder, ./risk-method-drafting/: the rulebook your team uses to score risks the same way (risk-method.md), and a record of two people scoring the same risks with it, to show it is repeatable (calibration.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The risk appetite and the acceptance threshold are leadership decisions; the skill proposes, it does not set them.

Inputs to gather

Read first: any existing method or matrix, the current register, the last year's financial size (revenue band, largest customer contract), the contractual uptime and notice commitments, incident records, and any regulator or customer letters. Then ask the reader in one message: what loss in money would change the year's plan, how many hours of outage the biggest customer would tolerate before escalating, how many people's personal data the company holds, and who in leadership signs spending at which level.

Step 1: choose the shape of the assessment

Decide, and write down why, whether risks are identified by scenario (threat, weakness, asset, consequence) or by asset first. Scenario-based suits companies under about 300 people with one product; asset-based suits estates with many systems and owners. State the scope the method covers, the unit of assessment, and that existing controls count toward residual scores only when there is evidence they run. Run a framework lookup for what the framework expects the method to contain; do not guess.

Step 2: anchor the scales in the company's own numbers

Write likelihood 1 to 5 as frequencies the team recognises, with one example from their own history per level where one exists. Write impact 1 to 5 across four to five dimensions, each anchored to a number:

Money: direct cost plus revenue at risk, as bands relative to the real figures (for example level 4 starts where the loss exceeds one month of revenue).
Operations: hours of outage of the main service, set against what contracts promise.
People and data: number of individuals affected and sensitivity; for privacy work, add harm to the individual as its own dimension, scored from the person's side, not the company's.
Legal and regulatory: from a warning letter up to a reportable breach or a sanction.
Customers and reputation: from one complaint up to losing the largest account.