Risk Matrix and Register
A heat map and a register that stay in sync: move a risk on the grid and its score, rating and mitigation row update together.
Templates ▾
Export ▾
Start from a real example
Pick one and change it to fit. Everything stays on this device. Nothing is uploaded.
| Severe | Medium5 | High10 | Critical15 | Critical20 | Critical25 |
|---|---|---|---|---|---|
| Major | Low4 | Medium8 | High12 | Critical16 | Critical20 |
| Moderate | Low3 | Medium6 | Medium9 | High12 | Critical15 |
| Minor | Low2 | Low4 | Medium6 | Medium8 | High10 |
| Negligible | Low1 | Low2 | Low3 | Low4 | Medium5 |
| Impact | Rare | Unlikely | Possible | Likely | Almost certain |
0 entries, 0 of them scored. Highest score on the grid: 0.
What this grid is telling you
- Nothing on the grid yet. Write the entries down first and score them afterwards.
Frequently asked questions
The questions people actually ask about this document.
- What is a risk matrix?
- A grid that scores each risk twice: how likely it is, and how much it would hurt. Where the two meet gives it a rating, and the rating decides how much attention it gets. The grid is the picture; the register underneath it, with an owner and a response on every row, is the part anyone actually works from.
- How do I score likelihood and impact?
- Likelihood over a stated period, not in general: a one in five chance this quarter is a different number from a one in five chance ever, and a register without a horizon is two people scoring different questions. Impact as the worst credible outcome, not the worst imaginable one. Both are judgements, and writing the reasoning beside the score is what lets somebody argue with it later.
- Why multiply the two scores instead of adding them?
- Because adding says that something almost certain and trivial deserves the same attention as something unlikely and catastrophic, and it does not. Multiplying pushes the corners apart, which is the behaviour people expect from these grids and the reason a five by five runs to twenty-five rather than to ten.
- Why does everything end up in the middle?
- Because scoring something high means somebody has to own it, and the middle is where nobody has to do anything. It is the most common failure in a real register and the easiest to spot: if nothing on your grid is red and nothing is green, the grid was filled in to be filed rather than to be used. Score the worst one honestly first and the rest tend to sort themselves.
- Who should the owner be?
- One named person who can actually change the odds or the damage, not a team and not a committee. The test is whether they could say in a sentence what they did about it last month. A risk owned by the project is a risk owned by nobody, which is the same as an unowned risk with extra paperwork.
- How often should it be reviewed?
- At whatever meeting already exists, rather than a meeting of its own. Monthly suits most projects, weekly once something is live and moving. What matters more than the interval is that the scores change: a register whose numbers are identical to last quarter is a document nobody read, and the review is the only thing that distinguishes a register from a list.