Understanding the Impact of Issues on Risk
Risks and Issues are linked in CyberHQ through calculations translating tactical issue severities and rating modes into real-time shifts in category likelihood, inherent risk, and overall Cyber Resilience scores
Issues and risk are directly connected in CyberHQ, so logging an issue does more than create a task: it changes your risk numbers. Since Release 2.6, risks, issues, controls and program activities all link to one another in any direction, which means a change in one place contributes to the others rather than leaving you to reconcile them by hand.
Understanding this link helps you see why an accurate, up-to-date Issues Register is essential to a defensible risk and Cyber Resilience posture, and why resolving issues genuinely improves your scores rather than just tidying a list. This article explains how that connection works.
How an issue raises risk
When you add an issue, it increases the likelihood of the risk categories it is associated with, which raises their inherent risk and lowers your overall Cyber Resilience score.
The size of that increase depends on the issue's severity, the combination of its Impact Level and Likelihood Level. Each severity level carries a multiplier, so a more severe issue pushes likelihood up further than a minor one.
Basic and Advanced rating
When rating an issue you can choose Basic or Advanced mode, and the choice affects the magnitude of the impact. Advanced mode produces a larger, more granular increase than Basic. For example, an issue rated with a Basic “yes” might raise a category's inherent score by around 0.08 (+1.7%), whereas an issue rated “high” in Advanced mode might raise it by around 0.17 (+3.3%). The exact figures depend on your matrix configuration.
How linkage shapes the rating
Linking an issue to one or more risks lets it inherit the category ratings of the highest-rated linked risk, shown with a Linked Risk source chip, which keeps your issue and risk numbers synchronised without re-entering them. Any rating you set by hand is marked Manual and is preserved even if the linked risk later changes. Categories covered only by a linked control, rather than by a linked risk, are auto-filled at a baseline value as a placeholder. This layered approach means each category's contribution to risk is always sourced from the most authoritative input available.
Because resolving an issue removes its contribution to inherent risk, working your register down directly improves your residual risk and Cyber Resilience scores. The Issues Register is one of the live inputs to the risk picture you report, which is why keeping it current matters as much as any setting.
How linked controls affect control effectiveness
Since Release 2.7, the controls you link to an issue flow through to risk control effectiveness. Previously, linking a control recorded the relationship and helped auto-fill category ratings; now it also contributes to how effective your controls are judged to be for the associated risk categories.
Controls linked to an issue are carried forward automatically to the relevant risk category, where they are used to calculate risk reduction. In practice this means an issue against a control does not only raise likelihood, it also reduces the credit that control receives for mitigating risk. That is why linking controls accurately matters: an Issue linked to the wrong control, or not linked at all, will leave your residual risk overstated or understated. You can see where this is concentrated using the Inadequate Controls widget on the Issues Report.
Since Release 2.7 your risk scores are calculated from your issues and their linked controls, with the separate exposure calculation removed so the same exposure is not counted twice. If your scores look different after upgrading, this simplification is the likely reason rather than any change in your posture.
How Issues and strategies affect risk together
Issues can also be linked to strategy actions, which in turn are linked to controls. What this can mean is that resolving issues can affect your Control Maturity, which in turn also impacts your Residual Likelihood score depending on if affected controls are linked to the same risk. Together with the control effectiveness pathway described above, this means your issue backlog influences your risk scores through more than one route, and keeping it current is essential to a defensible picture.