An Extended Risk Assessment Framework for Risk Prioritization and Management: Introduction of the Risk Absolute Score (RAS)

Research by: John Francis T. Diaz 

Executive Summary

This paper introduces the Risk Absolute Score (RAS), a novel enhancement to traditional risk assessment frameworks designed to address limitations in conventional risk prioritization methods. While existing frameworks primarily evaluate risks based on Impact and Likelihood, they often neglect the effectiveness of existing internal controls, leading to potential misallocation of resources. The RAS framework integrates the assessment of control effectiveness directly into risk scoring, providing a more comprehensive, control-sensitive approach to risk prioritization and management.

The RAS framework operates by incorporating a Control Assessment alongside traditional measures of Impact and Likelihood. Controls are rated on a scale of 1 (weak controls) to 5 (strong controls), reflecting the effectiveness of existing mitigation strategies. The Risk Absolute Score is calculated by dividing the conventional Risk Score (Impact × Likelihood) by the Control rating. As such, RAS = (Impact × Likelihood) / Control. A higher RAS indicates that a risk is either inherently significant, insufficiently controlled, or both—signaling a heightened need for managerial attention and resource allocation. Conversely, a lower RAS reflects either an inherently minor risk or one that is effectively managed through robust controls.

To illustrate the framework’s practical application, the paper presents a scenario comparing two cases of budget overrun risk: one where robust financial controls exist, and another where controls are weak. Despite identical inherent risk scores, the RAS is significantly lower in the first scenario, demonstrating how strong controls reduce the prioritization level of a risk. This example underscores the RAS framework’s value in differentiating between theoretically similar risks based on actual control effectiveness, thereby guiding management towards addressing critical control weaknesses rather than overestimating the significance of well-managed risks.

Managerially, adopting the RAS framework enables more accurate risk prioritization, resource optimization, and strategic risk communication. By integrating control effectiveness directly into the risk scoring process, organizations can better allocate resources to address genuine vulnerabilities, rather than relying solely on inherent risk characteristics. The framework also enhances risk communication by translating complex control assessments into an intuitive numerical score, facilitating understanding and action across different management levels.

For practical implementation, organizations are advised to establish consistent criteria for control assessments to reduce subjectivity, integrate the RAS into existing risk registers, and conduct periodic reviews to ensure continued relevance. Targeted training for risk owners on evaluating control strength is also recommended to maintain assessment accuracy.

Ultimately, the RAS framework offers organizations a more proactive and strategic tool for enterprise risk management, emphasizing the importance of existing controls in determining residual risk exposure. It bridges the gap between inherent risk assessment and real-world management readiness, supporting more informed decision-making and fostering organizational resilience. Future research is recommended to explore the framework’s adaptability across different industries and refine methodologies for control assessment.

Keywords: Risk assessment, risk management, risk prioritization, risk absolute score, control strength assessment

To cite this article: Diaz, J. F. T. (2025). An extended risk assessment framework for risk prioritization and management: Introduction of the risk absolute score (RAS). Economic Analysis Letters, 4(2), 81. https://doi.org/10.58567/eal04020004

To access the article: https://doi.org/10.58567/eal04020004

About the journal