Risk assessment

Open the risk and go to Assessment. Inherent is the risk before controls. Residual is the risk after the linked controls.

What you set

Set likelihood and impact for the inherent risk, and again for the residual risk. The rating beside each pair comes from the matrix. Open the matrix when you need the bands in front of you.

Change the controls first if the residual score should reflect a control you have not linked yet. The assessment does not invent controls of its own.