Complete firstRisk Storming
A list of identified risks is available (from Risk Storming, Pre-Mortem or discovery output), each with short description.
Without: Without risk list, the matrix becomes a brainstorming session and evaluation loses depth.
RunsheetDecision Making
Risk Matrix
ComplexityLow
Time30-60 min
Participants3-10
FormatWorkshop + async
MaturityCanonical
01
Prerequisite
What needs to be finished first
02
Preparation
What needs to be ready before start
Materials
Whiteboard or Miro board with matrix (3x3 or 5x5, probability horizontal, impact vertical); colored zones (green/yellow/red); risk list as cards; scale definitions visible; timer.
People / roles
One facilitator who keeps scale present and moderates consensus; 3-10 participants with risk context (engineering, operations, compliance, product, sponsor); one scribe for evaluation and actions.
Pre-read
Risk list distributed beforehand; written scale definition (for example probability 1=rare, 5=almost certain; impact 1=cosmetic, 5=existential); zone definition (green=accept, yellow=watch, red=action).
Time needed
30-60 min
Setup
Draw matrix grid on board (5x5 common). Label scale values. Mark zones with colors (green=P*I 1-6, yellow=7-14, red=15-25). Scale definitions visible as banner.
03
Core question
The one question this method answers
Where does each risk sit on probability-impact scale, and which risks need immediate action, which observation, which accepted exposure?
04
Flow
Marker: Phase
| Step | Duration | Action | Hint |
|---|---|---|---|
1Phase 1: Calibrate scale | 10 min | Review scale definitions together. At least one example per level (for example I=5: total outage >24h, I=1: tooltip wrong). Capture consensus. | Without calibrated scale, evaluation becomes gut feeling. If examples are not quickly tangible, sharpen scale definition before workshop. |
2Phase 2: Place risks individually | 15-30 min | Read each risk card, team estimates P and I separately (for example thumb signal or voting tool). On divergence discuss briefly, then consensus value or mean. | Maximum 2 min discussion per risk. If no convergence, take higher value (precautionary principle). Endless debates signal unclear scale. |
3Phase 3: Zone analysis | 10 min | Check risk distribution across zones. Extract red zone as top list. Yellow zone as watch list. Green zone documented as Accepted. | More than 10 red risks signals undervalued system risk or scale too strict. Recalibrate scale or reduce risk before continuing initiative. |
4Phase 4: Actions per high risk | 15-20 min | Define action per red risk: avoid, reduce (mitigate), transfer or accept. Set owner and deadline. Handover to ROAM Board or RAID Log. | Without action, matrix is picture book. At least every red zone has owner and next action. Accepting is valid action, but must be documented consciously. |
05
Artifact
What comes out at the end
Form
Matrix diagram (board export or photo) plus risk list in markdown or table with description, P, I, zone, action, owner, deadline. Scale definitions as header section.
Versioning / ownership
Snapshot per evaluation round with date. Document evaluation changes with rationale. Mark resolved risks as Resolved, do not remove. Quarterly new matrix as update, old archived.
Tool alternatives
- Miro or FigJam with Risk Matrix template
- Excel or Google Sheet with conditional formatting
- Confluence page with embedded table
- Jira with risk plugin
- Lucidchart with matrix template
risk-matrix-working-template.md
Compact working template for Risk Matrix with context, input, output artifacts, and next step.
Risk Matrix Working Matrix
| Element | Description | Rating | Evidence | Owner | Next step |
|---|---|---|---|---|---|
| 1 | |||||
| 2 | |||||
| 3 |
Output artifacts
- Risk Matrix:
- Top Risk List:
Decision or recommendation
What consequence follows from the matrix?
06
Example output
Concrete filled scenario, fictional example
risk-matrix-beispiel.md
Concrete filled scenario, fictional example
Risk Matrix - Order Service Release v2, 2026-05-18
Scale
- Probability: 1=rare (yearly), 2=possible, 3=likely (quarterly), 4=frequent (monthly), 5=almost certain (weekly).
- Impact: 1=cosmetic, 2=workaround available, 3=degradation, 4=partial outage, 5=total outage.
Evaluated risks (12)
| Risk | P | I | Zone | Action | Owner | Deadline |
|---|---|---|---|---|---|---|
| DB replication without failover | 4 | 5 | red | Mitigate (multi-leader spike) | @ben | 2026-05-30 |
| Payment webhook without retry | 3 | 5 | red | Mitigate (Sprint 23) | @anna | 2026-06-14 |
| Order Service bus factor 1 | 4 | 4 | red | Mitigate (knowledge sharing) | @lisa | 2026-06-15 |
| PSP breaking change Q3 | 3 | 4 | yellow | Escalate to PSP | @marcus | 2026-05-31 |
| Inventory without idempotency | 3 | 4 | yellow | Mitigate (Sprint 24) | @ben | 2026-06-28 |
| Outdated Order API docs | 2 | 2 | green | Accepted, quarterly review | @lisa | - |
Zone distribution: 3 red, 4 yellow, 5 green. Red zone manageable, actions in sprint plan.
07
Pitfalls
Recognize symptoms and steer against them
Trap
Scale without examples
Symptom
Participants interpret P=3 differently, ratings inconsistent.
What to do
Before rating, put at least one concrete example per scale level on wall. If unclear, interrupt workshop and sharpen scale, do not push through.
Trap
Multiplication overextended
Symptom
P*I treated as precise number, difference between 14 and 16 taken too seriously.
What to do
Scale is ordinal, not numerically exact. Zone transitions are rough orientation. For boundary cases, honest discussion, not arithmetic acrobatics.
Trap
Risks from workshop echo
Symptom
Evaluation shaped by dominant voice or senior opinion, quiet perspectives disappear.
What to do
Hidden voting (cards, tool) instead of open discussion. On divergence ask assumptions, do not force consensus.
Trap
Zones without action
Symptom
Red risks are evaluated, but no action derived.
What to do
For every red risk before workshop end, action type and owner. Accepted is valid but must be documented. Workshop does not end with unactioned red risks.
Trap
Static matrix
Symptom
Matrix created once, hangs in wiki, but risks change continuously.
What to do
Quarterly review cadence. Unplanned update on architecture or org change. Matrix is living artifact, not artwork.
08
Stop criteria
Done signals checkable in under a minute
No risk list available as input, matrix would be brainstorming instead of evaluation.
Scale definitions cannot be made clear, ratings would be gut feeling.
No stakeholder with decision competence for actions present, workshop ends without owner.
Participants do not know the risks substantively, evaluation would be speculation.
More than 30 risks in one session, discussion becomes superficial.
No follow-up tool (ROAM, RAID) planned, actions would be lost.
Finished the runsheet?
Go to the profile for purpose, similar methods, and sources or continue to the next method in the catalog.