Question

A risk manager is preparing a consolidated enterprise risk report for the board by combining risk data submitted independently by five business units. Each unit uses its own 1-to-5 scoring scale, but the definitions of what constitutes a '4' or '5' differ significantly between units (e.g., one unit defines '5' as a $1M loss while another defines it as a $10M loss). What should the risk manager do FIRST before aggregating the data?

Accepted Answer

Normalize the data by mapping each unit's scores to a common, consistently defined impact and likelihood scale

Answer

Sum the raw scores from all units to produce a total enterprise risk exposure figure

Answer

Present each business unit's scores separately without aggregation to preserve their original context

Answer

Apply the highest business unit's scoring scale to all units to ensure conservative reporting