Where a measure of risk combining consequence and likelihood is useful, qualitative, semi-quantitative or quantitative approaches may be used. Semi-quantitative scales are validated and used with care and their calculation basis explained. Qualitative and semi-quantitative measures only compare risks scored the same way or against criteria in the same terms and cannot be aggregated or used well where gains and losses trade off. A simple product loses the difference between rare severe and frequent minor risks, and a single value cannot describe all risks, for instance distributions, multiple causes or cumulative exposure. Expected value hides rare severe outcomes. Assumptions about controls (inherent, gross, residual or net risk) are stated explicitly, and uncertainties about assumptions and parameters are reported with the magnitude.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.