Risk Register Builder

Difficulty: Beginner · Track: GRC

Turn a real risk scenario into a scored, correctly escalated risk register entry.

Context

You're helping a fintech startup build its first risk register. A teammate wrote up a finding from a recent internal review. Your job is to score it and decide what happens next.

Task

Read the risk scenario and scoring rubric below (static, safe example).
Calculate the risk score from the given Likelihood and Impact ratings.
Apply the rubric to determine the required action and identify the control gap.

Risk Scenario

Answers are directly copy-pasteable from this block.

RISK SCENARIO — Internal Review Note Asset: Customer payment API (public-facing) Finding: The API server is running a web framework version with a publicly known vulnerability. A patch has been available for 60 days and has not yet been applied. Likelihood: 4 (Likely — public-facing, vulnerability details are public, no compensating control in place) Impact: 5 (Severe — could expose customer payment data) Company Risk Scoring Rubric: Risk Score = Likelihood x Impact (each rated 1-5, max score 25) 1-6 -> Accept (log and monitor) 7-14 -> Mitigate (assign an owner, remediate within 30 days) 15-25 -> Escalate (immediate review by Risk Committee)

Note: Educational example — names, systems, and figures are fictional.

Capture the Flags

Copy or calculate each answer from the scenario above. Case-insensitive.

0/3 flags captured

Flag 1 — What is the risk score?

Question: Calculate Likelihood × Impact from the scenario.

Flag 2 — What action does the rubric require?

Question: Using your Flag 1 score, copy the exact action word from the rubric.

Flag 3 — How many days was the patch available but unapplied?

Question: Copy the exact number of days from the finding.

Back to Challenges