Risk is scored by a competent assessor using a defined likelihood and consequence matrix. Where actions are required, the assessor assigns percentage reductions reflecting the anticipated impact of remediation. The system recalculates the risk outcome when actions are completed.