What is a risk matrix?
A risk matrix is the simplest way to compare and communicate risks. ISO 31000 and ISO 9001 (risk-based thinking) do not prescribe a method, and the risk matrix is the most widely used one. It works for quality, safety, supply chain, compliance and project risks alike. For detailed analysis of specific risks, use FMEA, hazard analysis or a bowtie.
Defining impact and likelihood levels
| Level | Impact | Likelihood |
|---|---|---|
| 5 | Catastrophic: death, recall, business-critical loss | Almost certain: expected regularly |
| 4 | Major: serious injury, regulatory finding | Likely: will probably occur |
| 3 | Moderate: medical treatment, customer complaint | Possible: might occur at some time |
| 2 | Minor: first aid, small cost | Unlikely: could occur but not expected |
| 1 | Negligible | Rare: only in exceptional circumstances |
Add numbers where you can (for example, cost bands or frequency per year) so different people rate the same risk the same way.
Risk matrix example
The example is a site quality risk register. Data integrity gaps in lab spreadsheets rate as extreme (impact 4, likelihood 4); moving to validated electronic forms brings the target down to high. A label mix-up and a ransomware attack are both high now (impact 5, likelihood 2), and their treatments target a medium rating. The "both" view draws an arrow from each initial rating to its target, so the effect of every treatment is visible at a glance.
Good practice
- Agree the criteria first and keep the same matrix across the organization.
- Rate as a team to reduce individual bias.
- Every risk has an owner and a review date.
- Re-rate after treatment, and check that the controls are actually effective.
How to use this Risk Matrix tool
- Set up your matrix. Choose 3×3, 4×4 or 5×5, rename the levels and click cells to match your risk policy.
- List your risks. Describe each risk, its category and its owner in the register.
- Rate impact and likelihood. Rate each risk in the table, or drag its marker to the right cell on the matrix.
- Plan the treatment. Record the treatment or controls and rate the target risk after treatment.
- Review and export. Switch between initial, target and both views, and export the register and matrix.
Frequently asked questions
What is a risk matrix?
A risk matrix (risk assessment matrix, probability and impact matrix or heat map) rates each risk by its likelihood and its impact. The combination places the risk in a cell, and the cell's colour shows the risk level, such as low, medium, high or extreme, which drives how quickly and at what level the risk must be treated.
Should I use a 3×3, 4×4 or 5×5 matrix?
A 5×5 matrix is the most common because it separates risks well without false precision. A 3×3 matrix is quick for simple, qualitative reviews. Whatever you choose, use one matrix consistently across the organization, with clear definitions for each level.
How is the risk score calculated?
In the default matrix the score is likelihood × impact (1 to 25): 1–3 low, 4–6 medium, 8–12 high and 15–25 extreme. Many organizations adjust individual cells, for example treating any catastrophic impact as at least high. In this tool you can click any cell to change its level.
What is inherent, residual and target risk?
Inherent (initial) risk is the risk before new controls; residual risk is what remains with the controls in place; target risk is the level you aim for once the planned treatment is done. Showing both on the matrix makes the effect of the treatment visible.
What are the limitations of risk matrices?
Ratings are subjective, ranges are coarse and very different risks can land in the same cell. Combine the matrix with clear rating criteria, team discussion, and more detailed methods such as FMEA, bowtie or quantitative analysis for the highest risks.