Severity labels that survive more than one reporting cycle

Trend reading dies when last year’s “significant” becomes this year’s “moderate” without a written rule. Financial teams in Hong Kong that keep a stable severity dictionary spend less time explaining vocabulary and more time on remediation.

Anchor to impact, not discomfort

Severity should reflect policy intent: amount thresholds, regulatory exposure, or override of a preventive control. A small petty-cash breach can be high severity if the manual treats custody as non-negotiable; a large payment with a late dual approval may be medium if the second approver was documented within the allowed window.

Publish the dictionary in the register pack

One page is enough. List labels, definitions, and examples from your own manuals. New committee members then stop asking whether “amber” means the same as last June.

Resist custom labels per engagement

External reviewers sometimes bring their own colour schemes. Ask them to map into yours. Our engagement approach includes agreeing labels in scoping so fieldwork does not invent a parallel language.

Stable labels make remediation follow-up cheaper: status changes are visible without re-arguing what the row meant when it was raised.