Each risk is rated on its probability of occuring and impact if it does occur. The organizationīs thresholds for low (dark gray), moderate (ligth gray) or high (black) risk as show in the matrix determines the riskīs score.