Risk Matrix

Likelihood runs along one side, usually from rare to almost certain, and impact along the other, from minor to severe. Each risk is placed in the cell that matches its scores, and the cell's colour, typically green, amber or red, signals priority. Organisations decide beforehand what each level means, for example a financial range for each impact band, to keep ratings consistent. Because the output is one picture, boards and committees use it in risk reports. The matrix has known limits. Coarse bands blur differences, scores are subjective, and two very different risks can land in the same cell. It sorts risks; it does not measure them. Non-specialists can see at a glance where attention should go.

A logistics company plots twelve risks on a five-by-five matrix. Data centre outage sits in the red zone, driver shortage in amber, and office fire in green. The board asks for action plans on the red items only, then reviews the matrix again at the next quarterly meeting.