Decision Making Decision method

Risk Matrix

Assesses well-formed risk scenarios with anchored likelihood and impact scales and connects priority to a response.

A Risk Matrix supports comparison when scope, time horizon, and scale anchors are explicit. Ordinal scores are conversation aids rather than precise mathematics; rare catastrophic outcomes and uncertain estimates require separate attention.

Core question

Which risks exceed our tolerance in the agreed horizon, and which response reduces them credibly?

Plan Risk Matrix Method guide

Start comparison

Give feedbackIs this method useful to you?

Participants: 3-10
Time: 30-60 min

The 5×5 values are ordinal categories. Their product is only a sorting aid and must not hide uncertainty or extreme consequences.

Paper illustration of a calibrated five-by-five risk matrix with response cards.

Calibrate
Anchor scales and thresholds
Define a scope-specific 5×5 scale with observable anchors and escalation rules.
Describe
Write precise risk scenarios
Describe each risk as a possible event with cause, consequence, affected objective, and existing controls.
Assess
Place inherent and residual risk
Assess likelihood and impact consistently while preserving disagreement and uncertainty.
Respond
Set response and monitoring
Agree a concrete treatment, owner, and review trigger for risks above tolerance.

Reassess likelihood, impact, and residual risk after controls, incidents, or context changes while retaining dated prior values.

A good fit when

Useful for a bounded risk decision with named scenarios and relevant experts. Use FMEA, scenario analysis, or quantitative models for detailed failure chains or loss distributions.

Ideal for

Steering board briefings
Project portfolio reviews
Compliance reviews

Not good for

Highly dynamic contexts with unknown risks

Outputs

Calibrated risk matrix
Risks with justified likelihood, impact, residual risk, and uncertainty.
Treatment plan
Prioritised responses with owners, dates, indicators, and review triggers.

Justified risk assessment

Fictional worked example

Connect each scenario to calibrated ratings, controls, and a decision; this is not a quantitative risk model.

Justified risk assessment
Risk	Risk scenario	Likelihood	Impact	Controls and residual risk	Response
Checkout loginIdentity-provider outage	If the identity provider is unavailable for more than 30 minutes, customers cannot sign in or purchase.	3/5: about once per quarter in 12 months of status history.	5/5: complete login and purchase stop, with revenue and support impact.	Manual fallback exists but is untested; residual risk 3×5=15.	Mitigate: Operations tests by 30 June; switch-over <5 minutes, no data loss; then reassess.

1. Risk scenario
Checkout login
If the identity provider is unavailable for more than 30 minutes, customers cannot sign in or purchase.
2. Likelihood
Checkout login
3/5: about once per quarter in 12 months of status history.
3. Impact
Checkout login
5/5: complete login and purchase stop, with revenue and support impact.
4. Controls and residual risk
Checkout login
Manual fallback exists but is untested; residual risk 3×5=15.
5. Response
Checkout login
Mitigate: Operations tests by 30 June; switch-over <5 minutes, no data loss; then reassess.

The number is an ordinal sorting aid. Anchors, uncertainty, extreme outcomes, and residual risk remain decision-relevant.

NIST SP 800-30 Rev. 1

First step

Set scope, time horizon, and verbal anchors for both axes before placing the first risk.

Open the method guide

Good to do first

Architecture

Risk Storming

Supplies the risks collected on the architecture diagram as the basis for scoring.

Where to go next?

Paper board with the four ROAM fields Resolved, Owned, Accepted, and Mitigated.

Agile

ROAM Board

Continues tracking the treatment status of each scored risk over time.

Delivery

RAID Log

Carries risk, action and owner forward in a running control log.

Deep dive

Purpose

When a project faces many possible disruptions, it quickly becomes unclear which risks deserve attention first. It separates options, evaluation criteria, and open risks. The result is captured as a Risk Matrix and a Top Risk List.

How it works

Each risk is viewed along two dimensions and placed into a shared priority logic. The matrix distinguishes rare but catastrophic issues from frequent, moderate disruptions. This allows protective measures to be concentrated at the riskiest points.

In detail

The Risk Matrix positions each identified risk on a likelihood versus impact scale, usually with three or five levels per axis. Colored zones mark urgency. It is often used in project management, security, and compliance contexts and is good for structuring discussion instead of leaving it open.

Facilitation

Write down the scale values before the session. Gather a separate rating for each risk across the group, then decide on an average or a consensus outcome.

The method guide walks execution through 4 phases, timing, 4 pitfalls, and clear stop criteria.

Open method guide

Your perspective

Does this method help with your work?

Your feedback helps shape the next improvements to methodatlas.

Sources and topics

Topics

Risk Decision Prioritization Assessment

Sources

NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessmentscsrc.nist.govNIST Special Publication 800-30 Rev. 1; institutional guidance for risk assessment of information systems.

In playbooks

Conduct Risk and Readiness ReviewMove from optimism to visible risks, controls, tests, and release decision.

Artifact templates

Risk Matrix: WorksheetPlan calibration, assessment, and treatment for a bounded risk set.

markdown

risk-matrix-working-template.md

Plan calibration, assessment, and treatment for a bounded risk set.

Risk Matrix: Worksheet

Question

To be confirmed

Desired outcome

To be confirmed

Scope

Full risk review Time: 45–60 minutes

Complete this worksheet on paper or in your own document during the work.

Preparation for this scope

Method setup

Materials: 5×5 workspace, risk list, incident history, control evidence, scale anchors, and decision log.
Roles: Facilitator, risk owner, likelihood and impact experts, and a person authorised to accept or escalate risk.
Advance information: Prepare scope, horizon, tolerance, current controls, and reference cases.
Overall time needed: 45–60 minutes for 8–12 risks; data collection and treatment work are additional.
Setup: Label axes 1–5 with concrete anchors and display the extreme-outcome and uncertainty rules.

Prepare for the work steps

Calibrate: Anchor scales and thresholds

Decision scope and time horizon
Risk tolerance or escalation rules
Historical incidents or reference cases

Describe: Write precise risk scenarios

Risk sources and assumptions
Process, system, or market knowledge
Existing controls

Assess: Place inherent and residual risk

Calibrated scales
Assessable scenarios
Control effectiveness and case data

Respond: Set response and monitoring

Justified matrix
Risk tolerance
Response options and responsibilities

Justified risk assessment

Risk	If …, then …	L 1–5 + anchor	I 1–5 + anchor	Controls · residual risk	Response · owner · date
Checkout login

Checkout login: Identity-provider outage

For each risk, complete scenario, L/I anchors, controls, residual risk, and response.

NIST SP 800-30 Rev. 1

Calibrate: Anchor scales and thresholds

Expected artifact: Calibrated scales

5 likelihood anchors · 5 impact anchors · thresholds · extreme-outcome rule

Entry:

...

Can two people place the same reference case within one level?
Does a catastrophic risk remain visible even when likelihood is low?

Describe: Write precise risk scenarios

Expected artifact: Assessable risk list

Event · cause · consequence · objective · control · evidence status

Entry:

...

Is each item an uncertain event rather than an issue that has already occurred?
Is the assessed consequence explicit?

Assess: Place inherent and residual risk

Expected artifact: Justified matrix

L · I · category · rationale · residual risk · uncertainty

Entry:

...

Can the cell be traced to scale anchors and evidence?
Was the ordinal score kept separate from precise loss probability?

Respond: Set response and monitoring

Expected artifact: Risk treatment plan

Response · action · owner · date · indicator · residual risk

Entry:

...

Does every high risk have a decision rather than only a colour?
Is it clear when the assessment becomes stale?

Open questions and next steps

...

Method guide: https://methodatlas.meierhoff-systems.de/en/methods/risk-matrix/run-sheet

Alternatives and neighbors

Fitting alternatives with decision guidance, followed by other related methods.

All methods

Agile

ROAM Board

Instead of Risk Matrix, choose ROAM Board when you want to discuss risks together and only need a living status of actions.

Operations

Failure Mode and Effects Analysis

Instead of Risk Matrix, choose Failure Mode and Effects Analysis when you want to systematically safeguard against failure modes, effects, and countermeasures.