Skip to content

Risk Assessment Matrix

At a glance

  • Purpose: Give everyone the same way of judging how serious a risk is, so scores are comparable, arguments are about evidence rather than adjectives, and thresholds mean something.
  • Use it when: During risk assessment, and again to compare residual exposure after responses. It is the scoring rule behind the risk register.
  • Owner: The project manager defines the scales; the project team and sponsor agree them.
  • Related: Module 08 · Lab 11 · Lab 17

How to use this template

  1. Agree the scales before scoring anything. The value of the matrix is that a score means the same thing whoever assigns it.
  2. Anchor each level to something concrete — a duration, a cost band, a legal consequence — not to adjectives. "High impact" is an opinion; "delays a milestone by more than two weeks" is a test.
  3. Score in two steps: probability first, then impact. Scores agreed in one step drift toward the assessor's general feeling about the project.
  4. Apply the threshold consistently: risks at or above it need a named owner and a written response, and the same threshold must be used at every review.
  5. Re-score residual exposure after the response. A matrix used only once, at identification, tells you the weather on one day.

Field descriptions

Field What goes in it Watch out for
Probability level A percentage band, with the words that go with it Precise-looking percentages with no basis
Impact levels Bands per dimension: schedule, cost, quality, legal A single impact scale for all dimensions
Exposure The product (or a lookup grid) of the two Averaging instead of multiplying
Threshold The score above which a response is mandatory A threshold nobody applies
Residual Exposure after the response Assuming total effectiveness
Opportunity scale The mirror image, for upside risks Registers with only threats

Blank template

# Risk Assessment Matrix — [Project name]

| | |
| --- | --- |
| **Version** | [1.0] |
| **Agreed with** | [Sponsor, team] |

## Probability scale

| Level | Label | Working definition |
| --- | --- | --- |
| 1 | Low | Unlikely during the project; no current evidence it will occur |
| 2 | Medium | Plausible; some evidence, or it has happened on comparable work |
| 3 | High | Likely; current conditions point to it occurring |

## Impact scale

| Level | Schedule | Cost | Quality or legal |
| --- | --- | --- | --- |
| 1 | Under one week of slip, recoverable within float | Under [x]% of budget | Cosmetic; no user-visible effect |
| 2 | One to two weeks of slip | [x–y]% of budget | User-visible defect, workaround exists |
| 3 | More than two weeks, or on the critical path | Above [y]% of budget | Regulatory or contractual breach; release blocked |

## Exposure grid

Exposure = probability × impact. Any risk scoring **6 or above** requires a named owner and a written
response, and is reported to the sponsor.

| Probability ↓ / Impact → | 1 | 2 | 3 |
| --- | --- | --- | --- |
| **1 — Low** | 1 | 2 | 3 |
| **2 — Medium** | 2 | 4 | **6** |
| **3 — High** | 3 | **6** | **9** |

Bold cells are at or above the threshold.

## Scale for opportunities

| Level | Probability | Benefit |
| --- | --- | --- |
| 1–3 | As above | [Bands, mirroring the impact scale] |

## Assumptions and limitations

- [e.g. Scores are ordinal. A risk scoring 9 is not three times as important as one scoring 3.]
- [e.g. The cost bands are relative to this project's budget, and must be re-anchored for another one.]

## Review record

| Date | Change | Reason |
| --- | --- | --- |

Worked example

Two risks from Lab 11 scored with these scales, invented figures for teaching:

Risk Probability Impact Exposure Verdict
Security review queue delays the integration by three weeks 3 (High — the queue is currently 12 deep) 3 (critical path, so more than two weeks) 9 Above threshold: named owner, written response, reported
Retention period confirmation is late 2 (Medium) 3 (legal consequence if configured wrongly) 6 At threshold: response required
A team member takes unexpected leave 2 (Medium) 1 (under a week, inside float) 2 Below threshold: accepted and monitored
The vendor offers an unused licence tier at no cost 1 (Low) 2 (reduces licence cost) 2 Opportunity, recorded, low priority

Two points the grid shows that prose does not. The legal risk scores 6 despite only medium probability, because impact alone can carry a risk over the threshold — a project that triages on probability will miss it. And the third row's low score is a deliberate accept: at exposure 2, spending a week to reduce it would cost more than the risk itself. That comparison — response cost against exposure — is the judgement the matrix exists to support, not to replace.

Common mistakes

  • Unanchored scales. If nobody can say what "impact 2" means in days or money, scores are opinions with numbers attached.
  • Multiplying across dimensions. A single impact level that mixes schedule, cost, and legal effect cannot be compared between risks; score the dimension that drives the response.
  • Treating exposure as a measurement. It is ordinal and comparative, not arithmetic — see the limitation note above.
  • A threshold that is not enforced. If risks above the line have no owner, the matrix is decoration.
  • Scores that never change. A register whose risk scores are identical at identification and close has not been reviewed.
  • Threats only. Omitting opportunities systematically biases the project toward pessimism and hides cheap wins such as reusing an existing component.
  • No residual column. Without it, you cannot tell whether the response achieved anything.