Inherent risk bands
Risk bands describe the task before controls: low, medium, high, or critical.
Definition
Risk bands describe the task before controls: low, medium, high, or critical.
V1 rule
Required controls may make a workflow permissible but do not lower the v1 inherent-risk band. Assign the band from the plausible consequence before proposed safeguards. A control may permit a safer workflow, but the underlying task keeps the same inherent-risk band.
Operational test
- Low: Errors are easy to detect and reverse, with little consequence beyond minor rework.
- Medium: Errors can create material rework, confusion, limited disclosure, or bounded external impact.
- High: Errors can materially affect people, money, rights, operations, security, or reputation.
- Critical: Errors can cause severe or difficult-to-reverse harm, or the task crosses an explicit product boundary.
Worked example
Adding qualified legal review to contract analysis may improve the workflow, but it does not make the underlying legal consequence low risk. Review depth and autonomy remain appropriate to high risk.
Record and reassess
- Record the consequence, affected party, reversibility, error-detection path, band, and rule that set it.
- Reassess when purpose, intended reliance, affected people, scale, data, action, or consequence changes.
Scope
The Task Fit Check applies inherent risk bands from categorical answers and deterministic house rules. It does not inspect the real environment, verify professional credentials, determine applicable law, or certify residual risk.