Risk impact and probability scores are always subjective because: Of the inherent uncertainty of future events. Auditors should maintain some ability to pursue individual goals, such as networking with (or avoiding) particular leaders. Experts can calculate the expected losses from all kinds of events. The use of specialized software, especially with Artificial Intelligence, has not been adopted yet by all organizations