What is a Risk Heat Map?
A risk heat map is a color-coded chart, usually built on a risk matrix, that plots an organization's risks by likelihood and impact so leaders can see where exposure concentrates.
- A risk heat map plots each risk by likelihood and impact on a color-coded grid so a board can see where exposure concentrates and how it has moved.
- IEC 31010 and COSO both describe it as a display and ranking technique; the care that goes into the assessments behind it decides whether it is honest.
- Show residual risk against appetite, with the inherent position alongside to show what the controls contribute.
- Avoid the common pitfalls: clutter, false precision, inconsistent scales across units, static snapshots and colors with no required response.
- Keep it to the top ten to twenty risks and the same set across periods so trends are visible.
What is a Risk Heat Map?
A risk heat map is a color-coded visualization, usually built on a risk matrix, that plots an organization's risks by likelihood and impact so leaders can see where exposure concentrates and which risks need attention.
IEC 31010:2019, the ISO and IEC standard on risk assessment techniques, treats the consequence and likelihood matrix and the heat map as one technique for displaying and ranking risks. COSO's thought paper Risk Assessment in Practice describes plotting any two assessment factors, such as impact and likelihood, or vulnerability and speed of onset, against each other as a heat map to inform prioritization. The heat map is the standard page in a board risk report, which is why its construction deserves as much care as the assessments behind it.
Why it matters
- It communicates. A single chart tells a board where the top risks are and how they have moved since the last report.
- It shows portfolio shape. Clusters in the top right corner, or an empty low-impact region, say something about the organization's assessment habits as well as its exposure.
- It anchors the conversation on appetite. Drawing the appetite boundary on the map makes every risk outside it a decision.
Reading a heat map
Each point is a risk, positioned by its likelihood and impact ratings; the cell color is the risk level from the underlying matrix. Common enhancements are separate markers for inherent and residual positions joined by an arrow to show control effect, marker size for a third factor such as velocity or financial exposure, and color or shape for category or owner. Movement between reporting periods matters more than position: a risk drifting toward the top right is the signal to act on.
Inherent, residual and target views
An inherent view shows exposure with no controls and highlights where the organization depends on its controls most. A residual view shows the current position and is the one compared with appetite. A target view shows where treatment plans are meant to take each risk. Presenting residual and target together turns the map into a progress report on the treatment portfolio.
Pitfalls
- Clutter: plotting every register entry produces an unreadable cloud; show the top risks per category and link to the register for the rest.
- False precision: points imply exact values that ordinal ratings do not have.
- Inconsistent scales: if business units use different descriptors, the map compares apples with oranges.
- Static maps: a map without prior positions or targets shows a snapshot, not a trend.
- Color without thresholds: a red cell means nothing unless it is tied to a required response.
Related terms
- Risk register
- Risk assessment
- Risk scoring and prioritization
- Risk appetite and risk tolerance
- Risk monitoring
- Enterprise risk management (ERM)
In SmartSuite
SmartSuite Enterprise Risk Management draws heat maps directly from the risk register's likelihood and impact ratings, filtered by category, entity or owner and showing inherent and residual positions, so the board chart and the underlying assessments are always the same data.
Frequently asked questions
What is the difference between a heat map and a risk register?
The register is the record: every risk with its description, owner, ratings, controls and actions. The heat map is a picture drawn from the register's likelihood and impact ratings. The map summarizes and communicates; the register holds the detail and the audit trail behind each point on the map.
Should we plot inherent or residual risk on the heat map?
Both, if the audience can read it. Residual risk is the position that matters against appetite and is the default for board reporting. Showing the inherent position too, joined by an arrow, demonstrates how much the controls contribute and which risks would escalate fastest if a control failed.
How many risks belong on a board heat map?
Usually the top ten to twenty enterprise risks, with category maps beneath for detail. A map with a hundred points cannot be read and invites the board to manage the register rather than the risks. Choose the risks whose movement the board should track, and keep the same set across periods so trends are visible.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.