A risk assessment matrix plots each risk by likelihood and impact, usually on a 5 by 5 grid coloured green, amber and red. It is a fast, visual way to compare many risks and start a conversation about priorities. Its limitations are well documented: the scores are rough categories rather than measurements, different people interpret them differently, and very different risks can end up with the same score. Use a matrix to sort and communicate risks, and use deeper analysis for the few decisions where the stakes are high.
Construct a simple example
Step 1: define the scales. Each score needs a written definition, or people will guess.
| Score | Likelihood (within 12 months) | Impact |
|---|---|---|
| 1 | Rare: under 5% | Loss under £10,000; no customer effect |
| 2 | Unlikely: 5 to 20% | £10,000 to £100,000; minor customer effect |
| 3 | Possible: 20 to 50% | £100,000 to £500,000; some customers affected |
| 4 | Likely: 50 to 80% | £500,000 to £2 million; significant customer or regulatory effect |
| 5 | Almost certain: over 80% | Over £2 million; major regulatory or reputational damage |
Step 2: rate each risk against those definitions.
Step 3: plot the risks on the grid and agree what each colour means for action.
A fictional example:
| Risk | Likelihood | Impact | Position |
|---|---|---|---|
| Key supplier fails | 2 | 4 | Amber |
| Website outage over 4 hours | 3 | 2 | Amber |
| Serious data breach | 2 | 5 | Red |
| Minor staff turnover increase | 4 | 1 | Green |
Explain ambiguity and scoring limits
Researchers and practitioners have pointed out several problems with qualitative risk matrices, for example in Louis Anthony Cox's 2008 paper "What's Wrong with Risk Matrices?" in the journal Risk Analysis. The main issues:
- Scores are categories, not numbers. Multiplying likelihood 2 by impact 5 to get "10" treats the scale as if the gaps were equal. They are not: the difference between impact 4 and 5 may be millions of pounds.
- Range compression. A risk with a 21% chance of a £490,000 loss and one with a 49% chance of a £110,000 loss both score 3 by 3, although their expected losses differ.
- Inconsistent interpretation. "Possible" or "major" mean different things to different people, especially without written definitions.
- Rare, severe risks get underrated. A low-probability catastrophe can sit in the same amber box as a nuisance.
- One score hides uncertainty. A single point does not show how confident you are, or the range of possible outcomes.
- Risks interact. A matrix treats each risk separately, while in reality one event can trigger several others.
When deeper analysis is needed
Keep the matrix, but go further for risks that are:
- close to or above your risk appetite
- low in likelihood but severe in impact
- the basis for a major investment or strategic decision
- dependent on several other risks
Options include:
- Ranges instead of points: estimate a low, likely and high loss, and a probability range.
- Scenario analysis: describe two or three specific scenarios and their consequences in detail.
- Quantitative modelling: simulation methods, such as Monte Carlo analysis, where data allow.
- Bow-tie analysis: map causes, the event, consequences and the controls on each side.
Using a matrix well
- Write definitions for every score and share them.
- Rate as a group, and discuss disagreements rather than averaging them away.
- Record the reasoning behind each rating.
- Do not rank risks precisely by their product score.
- Treat red as "needs a decision", not as the end of analysis.
Related reading
- Enterprise risk management subject guide: frameworks, registers, appetite, assessment and the course
- Risk register practice pack: a worked register entry with defined scales
- How to build an enterprise risk management framework
- Risk register example: fields, ownership and review
- Risk appetite vs risk tolerance
Assessment methods and their limits are covered in our enterprise risk management training.
The bottom line
A risk matrix is a good sorting tool and a poor measuring tool. Define your scales, use it to prioritise and communicate, and do deeper analysis before making high-stakes decisions.