Just use Open FAIR instead of CVSS and the Owasp Risk Rating Methodology. Forgo any old ratings you have and definitely avoid the vendor-driven scores. There are some nice facets of the OWASP Risk Rating Methodology (a major consultancy I worked for a few years back used it to great success with our clients) as well as CVSS (especially v3), but I think FAIR speaks to risk committees, board of directors, other executives, auditors, regulators, and anyone else who needs to join the growing conversation around cyber risk.
FAIR, or the Factor Analysis of Information Risk, is well-documented in the book, Measuring and Managing Information Risk -- and the book goes into detail why NIST SP 800-30, FIRST CVSS, and non-standard risk language found in all of the other frameworks aren't as sound as something like FAIR. Parts of FAIR are set in stone, while other parts, such as the vehicles for calculation (i.e., PERT and MC VaR) are changeable (e.g., PERT with P-Box, MC VaR with Bayesian Networks).