The impact (or consequence) of a risk refers to the extent to which the risk event could potentially affect the organization. Risk impact is often calculated by factoring in threats to the company’s security, finances, reputation, safety or operations. Assessing impact should be performed on a 1-10 scale over more commonly used high-medium-low scales. Using a 1-10 scale provides more flexibility and makes calculating residual risk more straightforward. The key is to express severity of impact in both quantitative and qualitative terms in a standardized way.