A Risk Matrix supports comparison when scope, time horizon, and scale anchors are explicit. Ordinal scores are conversation aids rather than precise mathematics; rare catastrophic outcomes and uncertain estimates require separate attention.

1. 1

   Calibrate

   Anchor scales and thresholds

   

   Goal

   Define a scope-specific 5×5 scale with observable anchors and escalation rules.

   Inputs for this step

   • Decision scope and time horizon
   • Risk tolerance or escalation rules
   • Historical incidents or reference cases

   Actions

   • Define each likelihood level as a range or defensible frequency.
   • Anchor each impact level with examples for cost, users, operations, and compliance.
   • Agree threshold, extreme-outcome rule, and treatment of high uncertainty.

   Output

   Calibrated scales

   5 likelihood anchors · 5 impact anchors · thresholds · extreme-outcome rule

   Quality check

   Can two people place the same reference case within one level? Does a catastrophic risk remain visible even when likelihood is low?

   Pitfall

   The group assigns numbers without explaining the real frequency or consequence behind each level. Anchor every level with a range and reference case; mark uncertainty separately where data is missing.

   Timing: 10–15 minutes

2. 2

   Describe

   Write precise risk scenarios

   

   Goal

   Describe each risk as a possible event with cause, consequence, affected objective, and existing controls.

   Inputs for this step

   • Risk sources and assumptions
   • Process, system, or market knowledge
   • Existing controls

   Actions

   • Write the risk as 'If cause/event, then consequence'.
   • Add affected objectives, consequence scope, and current controls.
   • Record evidence, data gaps, and assessment date on the item.

   Output

   Assessable risk list

   Event · cause · consequence · objective · control · evidence status

   Quality check

   Is each item an uncertain event rather than an issue that has already occurred? Is the assessed consequence explicit?

   Pitfall

   Entries such as 'security' or 'supplier' name a topic but no assessable event or consequence. Rewrite the entry as an if-then statement with an affected objective.

   Timing: 10–15 minutes

3. 3

   Assess

   Place inherent and residual risk

   

   Goal

   Assess likelihood and impact consistently while preserving disagreement and uncertainty.

   Inputs for this step

   • Calibrated scales
   • Assessable scenarios
   • Control effectiveness and case data

   Actions

   • Assess the risk before additional controls and record the rationale.
   • Assess residual risk after existing effective controls separately.
   • Capture divergent views as a range or open data question.

   Output

   Justified matrix

   L · I · category · rationale · residual risk · uncertainty

   Quality check

   Can the cell be traced to scale anchors and evidence? Was the ordinal score kept separate from precise loss probability?

   Pitfall

   The team multiplies two ordinal numbers and treats the result as objective precision or the only ranking. Review anchors, rationale, uncertainty, and extreme outcomes next to the score; discuss ties substantively.

   Timing: 15–20 minutes

4. 4

   Respond

   Set response and monitoring

   

   Goal

   Agree a concrete treatment, owner, and review trigger for risks above tolerance.

   Inputs for this step

   • Justified matrix
   • Risk tolerance
   • Response options and responsibilities

   Actions

   • Choose and justify avoid, reduce, transfer, or accept.
   • Set action, owner, date, leading indicator, and expected residual risk.
   • Agree a review date or trigger for reassessment.

   Output

   Risk treatment plan

   Response · action · owner · date · indicator · residual risk

   Quality check

   Does every high risk have a decision rather than only a colour? Is it clear when the assessment becomes stale?

   Pitfall

   The matrix ends with red cells but no decision, owner, indicator, or review date. Add a response and measurable review trigger for every risk above threshold.

   Timing: 10–15 minutes