How to set a target risk score on Mac
You can do this with RiskOS, a risk register for macOS. Two more ratings, a gap you can measure, and the strength of control that would close it.
A target is the one number on a risk that is not a measurement. Inherent and residual describe where things stand; the target states where you have decided to get to, and by implication what the treatment plan is actually for. Set it well and a register stops being a list of worries and becomes a set of commitments with arithmetic attached.
A target is a statement of intent, not an adjustment. Setting one never moves the residual score by itself — only the controls you link, or an effectiveness value you set by hand, do that.
What a target is for
Inherent and residual are enough to rank a register and not quite enough to manage one: on their own, nothing on the row says what good would look like. A target supplies it. Because it is expressed in the same two ratings as everything else, RiskOS compares it with the residual directly and adds the part people usually argue about in meetings — what strength of control it would take to get from one to the other.
Where the target lives
Choose Risks in the sidebar and select a risk. The panel on the right leads with Summary; below it sits Assessment, and every rating on the risk is set there. Inherent likelihood and impact sit near the top, with control effectiveness, onset velocity and detectability beneath them, and the target likelihood and target impact steppers further down the same section.
Under the steppers sit the two displays that make a target worth setting. The matrix carries three markers — inherent, residual and target — with a legend naming each, and they glide from cell to cell when a rating changes. Below it, a comparison grid lists inherent, residual, target and the gap between them, followed by a line telling you what strength of control would reach the target. The register table carries a Target column too; if you cannot see it, right-click the table header and switch it on.
Set a target on a risk
-
Open the risk you intend to move
Choose Risks in the sidebar and click the row. Targets are set one risk at a time, so start where the distance does real work: the rows above your appetite, or in the High and Critical bands.
-
Open the Assessment section
Move to Assessment in the panel on the right. It holds every rating the risk carries, in one order: the inherent steppers first, then control effectiveness, onset velocity, detectability and an optional exposure amount, then the two target steppers. Scroll past the inherent ratings to reach them.
-
Read where the risk stands today
Read the two figures already there before setting anything. Inherent is the exposure with nothing standing in its way; residual is what is left once the linked controls are counted. A target only means something as a distance from the residual, so know that number first.
-
Set the target likelihood
Choose from Rare, Unlikely, Possible, Likely and Almost Certain on the segmented stepper, exactly as you would for an inherent rating. Ask how often you intend this to be a live possibility once the plan is finished — not how often you would like it to be, which is always Rare and tells nobody anything.
-
Set the target impact
Choose from Insignificant, Minor, Moderate, Major and Severe. Impact is the harder of the two to move, because it describes the consequence once the event has happened rather than the chance of it happening. Be honest about whether your plan reduces the consequence or only its frequency.
-
Watch the target marker settle
The matrix gains a third marker and slides it to the cell your two ratings name. Read the three together: inherent, residual and target should step towards the mild corner of the grid, each one nearer it than the last. A target sitting in the same neighbourhood as the residual means the plan is not asking for much. The legend names each marker, so there is no guessing which one you are reading.
-
Read the gap in the comparison grid
The comparison grid shows all three scores with the gap between residual and target as a number of points. That gap is the size of the job. Eleven points is a programme of work with a budget; two points is an afternoon spent tidying a control and writing down what you found.
-
Read what strength of control it would take
Under the grid, a line names the strength of control that would bring the residual down to the target. Treat it as the specification for the treatment plan. If it asks for more than anything you have, build that control, accept a nearer target, or record the difference and escalate it.
-
Turn the target into a treatment plan
Open Treatment, choose Mitigate, Accept, Transfer or Avoid, write the plan and set a due date. Add the actions that carry it in Actions, each with an owner and a date. Changes save as you type, so the target and the plan that serves it are recorded together.
What the comparison grid is telling you
The grid is four figures and a sentence, and each part answers a different question. Read them in order and the argument for a treatment plan writes itself.
| Row | What it holds | The question it answers |
|---|---|---|
| Inherent | The likelihood and impact you rated, with nothing in the way | How bad would this be if we did nothing? |
| Residual | What is left once linked control effectiveness is counted | Where do we actually stand this morning? |
| Target | The likelihood and impact you intend to be living with | What are we trying to achieve? |
| Gap | The distance in points between residual and target | How much work is still outstanding? |
| Control strength line | The strength of control that would close that distance | What would it take to get there? |
Why the gap matters more than the target
Two risks can share a target of 4 and be in entirely different states. One has a residual of 6 and a control halfway through implementation; the other has a residual of 20 and an aspiration. Sorting by target tells you what people hope for. Reading the gap tells you where the work is.
Choosing a target you can defend
A target nobody believes is worse than no target, because it turns every review into a conversation about the number rather than the risk. Three habits keep them credible.
Start at the appetite, not at zero
Appetite is the highest residual score your organisation tolerates, set in Settings ▸ Appetite and inherited by every risk, with per-category thresholds and per-risk overrides where less tolerance is warranted. A target at or a little below that threshold is defensible by definition: it takes the risk out of breach. A target of 1 where appetite is 9 sets you up to miss by a distance that never mattered.
Move the rating a control can actually move
One choice in Settings ▸ Methodology decides whether controls reduce likelihood, impact or both, and it governs the direction a residual score can travel. Where controls reduce likelihood, a target that mainly lowers impact asks for something the treatment plan cannot deliver. Settle the methodology once, then set targets in the direction it allows.
Respect the floor and the ceiling
A residual score never falls below 1 and never rises above the inherent score, whatever you link to the risk. A target of 1 therefore means a control that leaves no meaningful exposure at all, which is rare enough to be argued for rather than typed in. Most defensible targets on a serious risk sit between 2 and 6.
A worked example
Take RSK-0007, Backup restoration has never been tested end to end, owned by M. Halvorsen in Business Continuity. It is Critical inherently, High after the controls currently in place, and six points above an appetite of 9. Here is the comparison grid once a target of Low is set.
| Figure | Value | What it says |
|---|---|---|
| Inherent | 20 — Critical | An untested restore path, with nothing in the way, sits near the worst corner of the matrix. |
| Residual | 15 — High | Immutable offsite backups operate at Moderate effectiveness, which helps but does not prove recovery works. |
| Target | 4 — Low | A rehearsed, evidenced restore that the team has watched succeed. |
| Appetite | 9 | Anything above this is flagged wherever the risk appears, so the target has to clear it. |
| Gap | 11 points | The work still outstanding, and the reason this risk carries a plan and a date. |
The control that would close the gap is already on the register: CTL-0003, Quarterly restore rehearsal, rated High. It reduces nothing today, because its status is Planned, and only controls that are implemented or operating reduce risk. The moment that status changes, RiskOS re-scores every risk deriving from it and the residual marker glides towards the target. That is the shape of a healthy target: a number, a named control that would reach it, and a date.
Targets across the whole register
Sort and scan the Target column
The table sorts on any column, so sorting on Target groups risks by the state you intend them to be in. Keep Residual beside it and the rows with an unaccounted-for distance stand out. Add the over-appetite filter and you are left with the risks that are both in breach and far from where they should be.
Revisit targets when you review
Review walks the risks that are due, one at a time, worst first, with the owner, actions, controls and last review beside the scoring inputs. It is the natural moment to ask whether a target set a year ago is still right, and the summary at the end shows what moved on each risk.
Report the distance, not the aspiration
A report built in Reports draws every section from one snapshot, so the summary, the matrix, the top risks and the per-risk detail pages agree with each other and with the screen. When the board asks how the year is going, the answer is the gap closing over time — which is what the residual score chart in a risk's History shows.
Troubleshooting
Setting a target did not change the score
That is the intended behaviour. The score at the head of the panel is the residual, and RiskOS derives it from the inherent ratings and the effectiveness of the controls in play. A target moves the third marker on the matrix and the target row in the comparison grid, and nothing else.
The target marker is hiding behind the residual marker
Both markers are in the same cell, which means your target is the position you already occupy. Either the risk is genuinely where you want it, which is worth saying in the treatment plan, or the target was set from the current rating rather than from the intent. The legend beside the matrix confirms which marker you are reading.
The grid asks for a stronger control than I have
Check the status of what you have linked before you change the target. A planned control reduces nothing yet, however strong it will eventually be, and the risk's Controls section says so. If the control really is operating and the line still asks for more, the target is beyond this treatment and should be revised or escalated.
The residual will not fall as far as my target
Three limits are usually behind this. A residual score never falls below 1. It never exceeds the inherent score, so a low inherent rating leaves little room to move. And the methodology decides whether controls act on likelihood, impact or both, so a target set in a direction it does not allow cannot be reached.
My target is still above appetite
Then the plan, even when complete, leaves the risk in breach. Lower the target so it clears the threshold, or open Appetite on the risk and turn on the override, which gives this one risk a stepper of its own and explains the threshold it would otherwise inherit. Write the reasoning into the risk's description while you are there. An override is occasionally the correct answer; what it must never be is silent.
Habits that keep targets honest
- Set a target only where there is a plan. A target with no treatment strategy, owner or date is a wish. Fill in Treatment in the same sitting, while the reasoning is still in your head.
- Name the control that would close the gap. Read the control strength line, then link or create the control that meets it. A gap with a named control against it is a project; a gap without one is a complaint.
- Check the target clears the appetite. If the number you intend to reach still sits above the threshold, the plan finishes before the risk becomes acceptable, and somebody should know that now.
- Review the gap, not the target. The distance between residual and target is the figure that shows movement. RiskOS keeps it on the comparison grid, so read it in Review at every pass and let it drive what gets attention.
- Re-set the target when the risk changes shape. A new system, supplier or regulation changes what good looks like. Update the target and write the reason into the description.
- Work the overdue actions first. Every overdue row in Actions is a gap that is not closing, and the Overdue group gathers them in one place.
Frequently asked questions
What is a target risk score?
A target risk score is the likelihood and impact you intend a risk to sit at once its treatment plan has done its work. It is rated on the same 1–5 scales as everything else, so it produces a score from 1 to 25 and falls in the same bands: Low 1–4, Medium 5–9, High 10–16, Critical 17–25.
How do I set a target risk score on a Mac?
Open the risk, open its Assessment section, and set the target likelihood and target impact on the steppers below the inherent ratings. The matrix adds a target marker and the comparison grid shows inherent, residual, target and the gap between them. Changes save as you type, so there is nothing to confirm.
Does setting a target change the residual score?
No. The residual comes from the inherent ratings and the effectiveness of the controls you link, or an effectiveness value you set by hand. A target is a statement of intent that sits alongside it, adds a third marker to the matrix, and gives the gap something to be measured against.
What should my target risk score be?
Start at your appetite. Appetite is the highest residual score the organisation tolerates, so a target at or a little below it takes the risk out of breach and is defensible without further argument. Going lower is a choice worth making deliberately, and worth explaining in the risk's description.
Why does RiskOS say I need a stronger control?
Because the distance between your residual score and your target is larger than the controls in play can close. The line under the comparison grid names the strength that would reach the target. Check the status of what you have linked first: a planned control reduces nothing until it is implemented or operating.
Can a target be lower than the residual score can go?
You can set one, but it will never be met. A residual score never falls below 1 and never rises above the inherent score, and the methodology decides whether controls reduce likelihood, impact or both. A target asking for movement in a direction the methodology does not allow cannot be reached.
Can I set the same target on several risks at once?
Targets are set one risk at a time. Selecting several risks turns the panel into a bulk editor for the fields where a shared value makes sense — category, owner, business unit, status, treatment strategy and review cadence — and anything left unticked stays as it was. A target belongs to one exposure and one plan.
Do targets appear in reports and on the register?
The register table carries a Target column you can show, hide or reorder by right-clicking the header, and the arrangement is remembered. Reports draw every section from a single snapshot, so the executive summary, the matrix, the top risks and the per-risk detail pages agree with what you read on screen.