How do you anchor risk-matrix impact bands so two raters land on the same cell?

## The problem anchors solve A risk matrix is only worth drawing if two competent people, handed the same threat, put it in the same cell. Without that, the grid is a device for laundering opinion into a colour. The usual reason they land differently is that the bands are defined by adjectives — Negligible, Minor, Moderate, Major, Catastrophic — which are synonyms for the rank position rather than definitions of it. Asked what separates Moderate from Major, an unanchored team argues about vocabulary. ## What an anchor is An anchor is a **concrete, checkable outcome** attached to a band. Compare: - Unanchored: `Impact 4 = Major business impact.` - Anchored, for a photo-sharing service: `Impact 4 = any cross-account read of another user's private media by an authenticated stranger, one account at a time. Impact 5 = the same read at bulk scale, or achievable with no account at all.` Four properties make an anchor work: - **Observable.** After an incident you could say plainly whether the described thing happened. - **In the product's own nouns.** "Private media", "another account", "bulk" beat "confidentiality breach". - **Bounded.** It says what falls outside as well as inside, so the neighbouring bands do not overlap. The step from 4 to 5 above is scale and required access, stated explicitly. - **Written first.** Anchors agreed before there is a finding to defend are wildly cheaper than anchors negotiated while someone's release date depends on the answer. The likelihood axis needs the same treatment: bands anchored on the preconditions an attacker must satisfy rather than on words like "Possible". Keep the two axes' anchors independent — an anchor that smuggles impact into the likelihood definition makes the cell double-count. ## One scale, very different products The hard case is a corporate 5x5 shared by, say, an identity platform team and a marketing microsite team. Under the shared grid, "Medium" comes to mean opposite things: a defaced microsite page in one review, something close to cross-tenant token issuance in the other. Two responses fail. Letting each team invent its own scale destroys any comparison across the portfolio. Forcing one literal anchor list on both makes it meaningless for at least one of them. The working answer is a **two-layer scale**: the organisation fixes the band count and the *business* meaning of each band (roughly what class of harm, disruption or regulatory exposure a band represents), and each product writes its own anchor table mapping its concrete outcomes onto those bands. The identity team's Impact 5 and the microsite team's Impact 5 then describe different technical events but comparable business consequences, which is exactly what a shared scale is for. ## Calibration: how you find out whether it worked Anchors are a hypothesis until tested. Take eight to ten threats already settled and uncontroversial. Two raters score them independently, without conferring. Then compare cell by cell and look at *where* they diverged, not just how often. A split on one particular band boundary is a wording defect in that band; a scattered split suggests the axis itself is not anchored at all. Rewrite, re-test, and keep the settled cases as a precedent table — over time the accumulated worked examples do more for repeatability than the prose definitions do. ## The failure modes anchors actually fix - **Central tendency.** With vague bands, the middle is the safe choice for a rater who does not want to be wrong, and ratings pile up in the centre. - **Advocacy drift.** The person who found the issue rates it higher; the person who must fix it rates it lower. An anchor moves the argument from "how bad is it" to "did this outcome occur", which is answerable. - **Drift over time.** Last year's Major quietly becomes this year's Moderate as the team's tolerance shifts. Written anchors and precedent make the drift visible and deliberate. ## What anchoring does not fix Anchoring makes bands repeatable; it does not make the scale a measurement. The bands remain ordinal, so you still cannot multiply or average them. It also cannot supply judgment about harm nobody has yet experienced — for a novel threat class the anchors are an argument-starter, not an oracle. And an anchored, repeatable, beautifully documented rating that never changes what the team builds next is still theatre. Repeatability is a precondition for the matrix being useful, not proof that it is.