Currently you have to enter quantitative values to provide a risk rating number and level. Could there be an option to just have a level, even if in the background you had to use quantitative values the display would just be high, medium, low etc. The other rating criteria can then be the indicator for flagging the risk for follow up. For example if you have a high risk, with deficient control effectiveness but you had agreed it can be managed outside of the target level this would not flag for additional follow up that can be set up in the configuration. See image for examples. It would be ideal if target levels could be entered based on classifications assigned