In the context of risk scoring, which item is commonly configured by customers?

• A. Annualized Loss Expectancy
• B. Risk Criteria Matrix
• C. Control Failure Factor
• D. Indicator Failure Factor

Answer: (B)

Risk scoring hinges on turning diverse risk inputs into a clear, actionable rating that matches an organization's appetite. The item most commonly configured by customers is the Risk Criteria Matrix. By setting this matrix, a customer defines how different levels of likelihood and impact combine to produce a risk rating (low, medium, high, etc.). This customization lets the scoring align with the business context, regulatory requirements, and tolerance for risk, so prioritization and escalation decisions reflect what the organization actually values and can manage.

Other inputs like Annualized Loss Expectancy are useful for quantitative risk estimates, but they’re calculated from data such as asset value and exposure, rather than being the primary customization point for risk scores. Likewise, Control Failure Factor and Indicator Failure Factor are specific factors used in risk calculations but don’t provide the same direct, user-driven way to tailor how risks are scored and prioritized as the Risk Criteria Matrix does.