What a Risk Matrix Calculates
A risk matrix is a simple way to prioritize risks by combining two ratings: how likely the event is and how serious the impact would be if it happened.
With a 1 to 5 scale for both likelihood and impact, the risk score ranges from 1 to 25. Higher values usually require stronger controls, faster mitigation, or management attention.
5×5 Risk Matrix
| Impact ↓ / Likelihood → | 1 Rare | 2 Unlikely | 3 Possible | 4 Likely | 5 Almost Certain |
|---|---|---|---|---|---|
| 5 Catastrophic | 5 | 10 | 15 | 20 | 25 |
| 4 Major | 4 | 8 | 12 | 16 | 20 |
| 3 Moderate | 3 | 6 | 9 | 12 | 15 |
| 2 Minor | 2 | 4 | 6 | 8 | 10 |
| 1 Insignificant | 1 | 2 | 3 | 4 | 5 |
Risk Level Bands Used Here
| Score | Level | Typical action |
|---|---|---|
| 1–4 | Low | Monitor and manage with routine controls. |
| 5–9 | Moderate | Review controls and assign an owner. |
| 10–16 | High | Mitigation plan should be prioritized. |
| 17–25 | Extreme | Immediate attention, escalation, or stop-work review may be needed. |
Likelihood Scale
- 1 Rare: Very unlikely to happen.
- 2 Unlikely: Could happen, but not expected often.
- 3 Possible: Realistic chance of happening.
- 4 Likely: Expected to happen in many cases.
- 5 Almost certain: Expected to happen frequently or soon.
Impact Scale
- 1 Insignificant: Minimal effect.
- 2 Minor: Limited disruption or small loss.
- 3 Moderate: Noticeable disruption or cost.
- 4 Major: Serious consequences.
- 5 Catastrophic: Severe consequence, major loss, or safety-critical outcome.
Common Mistakes
- Averaging unrelated low, medium, and high risk categories instead of scoring each real risk.
- Using a risk matrix as a final safety decision instead of a prioritization tool.
- Not defining likelihood and impact scales before scoring.
- Ignoring existing controls and residual risk.
- Comparing risk scores from different teams that use different scoring definitions.
Frequently Asked Questions
How do I calculate risk score?
Multiply likelihood by impact. For example, likelihood 3 and impact 4 gives a risk score of 12.
What is a 5×5 risk matrix?
It is a risk scoring table where likelihood is rated from 1 to 5 and impact is rated from 1 to 5.
Is the highest score always the first risk to fix?
Usually it is a priority, but not always. Legal, safety, cost, detectability, dependencies, and available controls also matter.
What is residual risk?
Residual risk is the risk remaining after mitigation controls are applied.