Creating a risk matrix (likelihood × impact) with example
A risk matrix is a table in which you score risks on two axes: the likelihood that something happens and the impact if it does. Multiply the two and you get a risk score. That score sets the colour in the matrix and tells you how quickly to act.
The risk matrix is the most widely used method for the risk analysis that ISO standards require in clause 6. You use it for risk management under ISO 9001, the risk analysis for ISO 27001 and assessing hazards and risks under ISO 45001. The technique is described in IEC 31010:2019 as a consequence/likelihood matrix, and it aligns with the risk management guideline ISO 31000 . To see how that guideline, which cannot be certified, structures your whole risk process, read ISO 31000 explained.
Is a risk matrix required for ISO certification?
No. No ISO management system standard prescribes a risk matrix. The standards require you to identify and assess risks and opportunities in a systematic way. A matrix is the simplest way to show that you do this.
| Standard | Clause | What the standard requires |
|---|---|---|
| ISO 9001 | 6.1 | Determine risks and opportunities and plan actions |
| ISO 27001 | 6.1.2 | Define criteria for risk assessment, estimate consequences and likelihood, produce consistent results |
| ISO 45001 | 6.1.2 | Identify hazards and assess occupational risks |
| ISO 14001 | 6.1 | Determine risks and opportunities related to environmental aspects and legal requirements |
ISO 27001 is the strictest. The auditor wants to see that two people using the same criteria arrive at a comparable score. For that you need defined scales, as shown below.
Step 1: define scales for likelihood and impact
A matrix only works if everyone understands “3” or “major” in the same way. So write down a description for each score. This is a template for a 5-point scale that you can adjust.
| Score | Likelihood | Impact |
|---|---|---|
| 1 | Very low: less than once every 10 years | Negligible: no noticeable consequence, damage under €1,000 |
| 2 | Low: once every 3 to 10 years | Minor: one client affected, recovery within a day |
| 3 | Possible: once every 1 to 3 years | Noticeable: several clients affected, damage up to €25,000 |
| 4 | Likely: yearly or more often | Major: loss of an important client, reporting obligation |
| 5 | Very likely: monthly or more often | Severe: injury, fine, survival of the business at risk |
The amounts are an example. A business with €2 million in revenue sets its limits differently from one with €200 million. For ISO 45001, describe impact in terms of injury (first aid, sick leave, permanent injury) instead of euros.
Step 2: set up the 5x5 risk matrix
Multiply likelihood and impact. This gives a matrix with scores from 1 to 25. Then agree which colour belongs to which score, and what each colour means.
| Likelihood ↓ / Impact → | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | 5 yellow | 10 orange | 15 red | 20 red | 25 red |
| 4 | 4 green | 8 yellow | 12 orange | 16 red | 20 red |
| 3 | 3 green | 6 yellow | 9 yellow | 12 orange | 15 red |
| 2 | 2 green | 4 green | 6 yellow | 8 yellow | 10 orange |
| 1 | 1 green | 2 green | 3 green | 4 green | 5 yellow |
| Colour | Score | What you do |
|---|---|---|
| Green | 1-4 | Accept, reassess yearly |
| Yellow | 5-9 | Consider a measure, appoint an owner |
| Orange | 10-14 | Plan a measure within a quarter |
| Red | 15-25 | Act immediately, inform the management |
This line between acceptable and unacceptable is called your risk acceptance criterion. Under ISO 27001 you must record it explicitly and have management approve it.
Example: completed risk matrix for an IT service provider
An IT service provider with 30 employees is preparing for ISO 9001 and ISO 27001. This is part of the risk register, scored using the scales above.
| Risk | Likelihood | Impact | Score | Colour | Measure | Score after measure |
|---|---|---|---|---|---|---|
| Ransomware through phishing email | 3 | 5 | 15 | Red | MFA everywhere, offline back-up, phishing training | 2 × 4 = 8 |
| Key network administrator leaves | 3 | 4 | 12 | Orange | Document knowledge, train a second colleague | 3 × 2 = 6 |
| Hosting supplier goes bankrupt | 1 | 4 | 4 | Green | Accept, check finances yearly | 4 |
| Wrong configuration at a client due to haste | 4 | 3 | 12 | Orange | Four-eyes principle for changes | 2 × 3 = 6 |
| Laptop lost on the train | 4 | 2 | 8 | Yellow | Disk encryption (already in place), accept | 8 |
The “score after measure” column is called the residual risk. An auditor wants to see that the residual risk falls below your acceptance limit, or that management has deliberately accepted the higher risk.
Record opportunities in your register too, not only risks. ISO 9001 and ISO 45001 explicitly ask for “risks and opportunities”. You can score an opportunity with the same matrix, but then you score the benefit instead of the harm.
Which matrix do you choose: 3x3, 4x4 or 5x5?
A larger matrix seems more precise, but it makes scoring harder. For most small and medium-sized businesses, a 5x5 works well.
| Matrix | Advantage | Disadvantage | Suitable for |
|---|---|---|---|
| 3x3 | Quick, little debate | Too coarse, many risks end up in the middle | Small business, first risk analysis |
| 4x4 | No middle score, forces a choice | Less common | Teams that keep choosing “3” |
| 5x5 | Common, easy to justify | More debate per score | Most ISO projects |
For occupational risks in the Netherlands, you will also see the Fine and Kinney method used in the RI&E (risk inventory and evaluation). It adds a third factor: how often people are exposed to the hazard. The score is then likelihood × exposure × effect. You can read more about the RI&E on the Arboportaal (Dutch working conditions portal) and on our page RI&E and ISO 45001.
Step by step: using a risk matrix
Define scales and acceptance criteria
Have management approve them. They belong in your risk management procedure.
Gather risks
Use your context analysis, interested parties, incidents and audits. Work with a small team.
Score likelihood and impact
First score without new measures, but include what is already in place. Note why you chose each score.
Choose measures
Start with red and orange. Record an owner and a date.
Reassess
At least yearly, and directly after an incident or a major change. Discuss the outcome in the management review.
Common mistakes with a risk matrix
- No description per score. Then everyone scores on gut feeling and the results cannot be repeated.
- Everything is yellow. Whoever always picks a 3 ends up with a register that has no priorities.
- Same score, different risk. Likelihood 5 × impact 1 and likelihood 1 × impact 5 both give 5. A disaster with a small likelihood often deserves more attention. So always review risks with impact 5 separately.
- Making the matrix and filing it away. The auditor asks which measure from the register was carried out and what its effect was.
When is a risk matrix not enough?
For serious safety risks, you want to see which barriers prevent a disaster. For that you use a bowtie analysis. For product and process design in industry or the medical sector, an FMEA is common. For work on site in construction, you make a task risk analysis (TRA) for each task.