Risk matrix: how to use a 5×5 risk assessment matrix
The risk matrix is the most widely used tool in risk management — and one of the most misused. Here is how to build one that gives consistent answers, how to read it, and where its limits are.
A risk matrix is a grid that rates each risk by likelihood on one axis and impact on the other. On a 5×5 matrix both are scored 1–5 and multiplied, giving a score from 1 to 25 that maps to a colour-coded level — low, moderate, significant or critical — so that risks can be compared and prioritised on the same basis.
The 5×5 risk matrix
Rows: likelihood (5 = almost certain). Columns: impact (5 = severe). Bands: 1–4 low 5–9 moderate 10–14 significant 15–25 critical
Step 1: define the likelihood and impact scales
The matrix is only as good as the definitions behind its numbers. If one manager’s “likely” is another’s “possible”, the colours mean nothing. Give each level a quantitative anchor.
Likelihood scale
| Score | Label | Probability in the next 12 months | Or, for frequent events |
|---|---|---|---|
| 5 | Almost certain | > 80% | Several times a year |
| 4 | Likely | 50–80% | About once a year |
| 3 | Possible | 20–50% | Once every 2–5 years |
| 2 | Unlikely | 5–20% | Once every 5–20 years |
| 1 | Rare | < 5% | Less than once in 20 years |
Impact scale
Impact usually needs several dimensions, because not every consequence is financial. Score each risk on all relevant dimensions and take the highest.
| Score | Financial | Operations | Reputation and compliance | People |
|---|---|---|---|---|
| 5 Severe | > £1m | > 1 month disruption | Fine or licence at risk; loss of key customers | Fatality or multiple serious injuries |
| 4 Major | £250k–£1m | Up to 1 month | National media; formal investigation | Serious injury |
| 3 Significant | £50k–£250k | Up to 1 week | Local media; regulator enquiry | Lost-time injury |
| 2 Moderate | £10k–£50k | Up to 1 day | Customer complaints | Minor injury, first aid |
| 1 Minor | < £10k | < 1 hour | No external attention | No injury |
A useful rule of thumb: the top of your impact scale should be close to what your organisation could survive only with difficulty — often a meaningful share of annual profit or of cash reserves.
Step 2: set the bands and what each one requires
Colours are useful only if each colour triggers a defined response. Write it down:
| Level | Score | Required response | Reviewed |
|---|---|---|---|
| Critical | 15–25 | Escalate to leadership; treatment plan approved by the executive | Monthly |
| Significant | 10–14 | Treatment plan with owners and deadlines | Monthly or quarterly |
| Moderate | 5–9 | Named owner; actions at the owner’s discretion | Quarterly |
| Low | 1–4 | Accept; monitor at scheduled review | Annually |
Multiplication treats a rare-but-severe risk (1×5) the same as a near-certain trivial one (5×1). They are not the same: the first can end the business. Many organisations therefore move high-impact, low-likelihood cells up a band, or require every risk with impact 5 to have a continuity plan regardless of its score.
Step 3: score and read the matrix
Score each risk twice:
- Inherent — before any controls. Shows how dangerous the risk is in principle and which controls you depend on.
- Residual — with the controls that operate today. This is the score you prioritise and report on.
Many registers also record a target score: where the risk should sit once planned actions are complete.
Worked examples
| Risk | Likelihood | Impact | Score | What it tells you |
|---|---|---|---|---|
| Main warehouse unavailable for 3+ weeks (fire, flood) | 1 Rare | 5 Severe | 5 | Low probability, but survival-level impact: check insurance and continuity plan, not just the colour |
| Key developer leaves mid-release | 3 Possible | 3 Significant | 9 | Cheap controls (documentation, pairing) can move it to low |
| Phishing leads to business email compromise and a fraudulent payment | 4 Likely | 3 Significant | 12 | Needs a treatment plan: payment call-back checks, MFA, training |
| Largest customer (35% of revenue) does not renew | 3 Possible | 5 Severe | 15 | Strategic: escalate, plan diversification |
3×3 vs 4×4 vs 5×5: which size?
| Size | Good for | Watch out for |
|---|---|---|
| 3×3 | Quick task or site assessments; teams new to risk | Too coarse to separate risks in a register of 30+ |
| 4×4 | Forcing a decision — there is no comfortable middle score | Less common, so harder to compare with partners |
| 5×5 | Organisational and project risk registers; the most common choice | Needs well-anchored scales or everything drifts to 3×3 |
Larger grids (6×6 and beyond) rarely add value: people cannot reliably distinguish that many likelihood levels, so the extra precision is false.
The limitations of risk matrices
Risk matrices have well-documented weaknesses. Louis Anthony Cox’s 2008 paper “What’s Wrong with Risk Matrices?” in Risk Analysis showed that matrices can assign identical ratings to very different risks and, near band boundaries, can even rank risks in the wrong order. In practice the main problems are:
- Compression. A 10% and a 45% probability can both score 3.
- Subjectivity. Without anchors, scores reflect who was in the room.
- Everything amber. Uncertain assessors default to the middle.
- No aggregation. Ten moderate risks in one supplier can add up to something critical; the matrix will not show it.
None of this means you should abandon the matrix. It means you should use it as a prioritisation aid, not a measurement: anchor the scales with numbers, discuss boundary cases, look at clusters by category and owner, and quantify the few risks that matter most (expected loss, scenarios) instead of relying on a colour alone.
Tips for consistent scoring
- Score a specific scenario, not the worst imaginable one. “Two-day outage” and “total loss of data centre” are different risks with different likelihoods.
- Calibrate together: score three reference risks as a group first, then use them as yardsticks.
- Record the reasoning next to the score — next year’s reviewer will need it.
- Re-score after incidents and near misses. If a “rare” event happened twice this year, it is not rare.
Frequently asked questions
What is a risk matrix?
A grid that rates each risk by likelihood on one axis and impact on the other. The cell where they meet gives a score and a colour-coded level, so risks can be compared and prioritised consistently.
How do you calculate a score on a 5×5 matrix?
Rate likelihood 1–5 and impact 1–5 and multiply them. The result, from 1 to 25, maps to a level.
Which is better: 3×3, 4×4 or 5×5?
For organisational and project risk registers, 5×5. Use 3×3 for quick task-level assessments.
Is there a free risk matrix template?
Yes — our risk register template includes a colour-coded 5×5 matrix sheet, scales with example thresholds and automatic scoring.
A matrix that updates itself
In Risk Samurai every risk is scored on your own calibrated scales, and the matrix, top risks and trends update as owners review them. AI drafts the first version of your register.
Get early access