Risk
Severity vs materiality
Two different measures that are routinely conflated: what a check is worth in the abstract, and how far this failure reaches in this account.
Currentengine 9.0.0Verified 2026-08-30
The distinction
| Severity | Materiality | |
|---|---|---|
| Assigned by | The scanner | GovIntel, from observed evidence |
| Same for every customer | Yes | No |
| Measures | The check, in the abstract | This failure, in this account |
| Inputs | The nature of the control | Distinct resources, region spread, account scope, reachability, control class |
| Used for | Scoring weight, the critical ceiling | Ordering what leadership looks at first |
Why conflating them misleads
A critical control failing on one resource in one region and a medium control failing on forty across five are not the same governance problem, and severity alone cannot tell them apart.
Reporting only severity puts the second one below the first, every time.
Where severity still leads
The score, through the weights. The critical ceiling, which caps the band whatever the reach.
Where materiality leads
The material risks page, and the ordering of the register. What leadership should look at first is a question about reach.
What neither is
Neither models business consequence. That requires facts about your organisation that the assessment never sees.