What is a Risk Matrix?

What is a Risk Matrix?

A risk matrix is a grid that plots the likelihood of a risk event against the severity of its impact and assigns each cell a risk level, so risks can be rated consistently and compared.

NIST SP 800-30 Rev. 1 gives a reference version in its appendix on risk determination: a table that combines the likelihood that a threat event occurs and results in adverse impact with the level of impact, each on a five-point scale from very low to very high, to produce the level of risk. IEC 31010:2019, the ISO and IEC standard on risk assessment techniques, describes the consequence and likelihood matrix as a technique for ranking risks and screening them for further analysis. The matrix underlies most qualitative risk registers and is the structure a risk heat map visualizes.

Why it matters

• It makes ratings comparable. Two assessors using the same scales and matrix should place the same risk in the same cell.
• It ties rating to appetite. Cells map to response thresholds: accept, monitor, treat, escalate.
• It is fast. A matrix rates hundreds of risks quickly and reserves deeper analysis for the top cells.

Building a risk matrix

• Define the scales: usually five levels each for likelihood and impact, with written descriptors and, where possible, numeric anchors (probability ranges, financial bands, outage durations, regulatory consequences).
• Rate the cells: assign a level to each combination. NIST's table gives, for example, very high likelihood and very high impact a very high risk, and low likelihood with moderate impact a low risk.
• Set thresholds: decide which levels are within appetite, which require treatment and which require escalation, and who can accept each.
• Use multiple impact dimensions: financial, operational, regulatory, customer and reputational, taking the highest as the rating or recording each.

Reading a matrix

Position shows the rating; movement over time shows the effect of treatment. Most registers record an inherent position (before controls) and a residual position (after), and the distance between them is the value the controls provide. Consistency depends on the descriptors: an impact scale that reads major, significant, moderate without numbers will be applied differently by every assessor.

Limits of the risk matrix

A matrix is ordinal. Cells do not say how much larger one risk is than another, and combining likelihood and impact bands can rank risks incorrectly when true values sit at the edges of their bands. IEC 31010 notes these limitations. Treat the matrix as a screening tool, anchor the scales in numbers, and apply quantitative analysis such as FAIR to the risks whose position drives a decision.

Related terms

• Risk assessment
• Risk scoring and prioritization
• Risk register
• Risk appetite and risk tolerance
• Risk analysis
• Risk management

In SmartSuite

SmartSuite Enterprise Risk Management stores the likelihood and impact scales, descriptors and cell ratings as configuration, applies them to inherent and residual assessments in the register, and enforces the appetite thresholds through the workflow that routes risks above them for treatment and approval.

Frequently asked questions

What is the difference between a risk matrix and a heat map?

The matrix is the rating scheme: the scales and the level assigned to each combination of likelihood and impact. The heat map is the visualization of where the organization's risks sit on that grid, usually color-coded. A heat map is drawn on a matrix; the matrix exists whether or not anyone plots it.

Should a risk matrix be three by three or five by five?

Five by five is the common choice because it gives enough resolution to distinguish risks without demanding precision the assessors do not have. Three by three is adequate for simple screening; larger grids invite false precision. Whatever the size, written descriptors and numeric anchors for each level matter more than the number of levels.

How do we set impact scales?

Define impact bands per dimension in the organization's own terms: financial loss ranges tied to materiality or earnings, operational bands in service outage or customer numbers, regulatory bands from minor breach to license loss, and reputational bands by audience and duration. Align the top band with the board's risk appetite so the matrix and the appetite statement agree.