A risk assessment matrix (also called a heat map or a likelihood-impact grid) is a table that places each risk in a cell according to two ordinal ratings, how likely it is and how bad it would be, and colors the cells so that the top-right is red and the bottom-left is green. It is used to rank risks for a register, to score auditable entities for an audit plan, to rate the severity of findings and to decide which risks need treatment. It is quick, visual and understood by every board. It is also, as a line of academic work since 2008 has shown, capable of ranking risks in the wrong order, of placing a quantitatively smaller risk in a redder cell than a larger one, and of producing different answers from different raters looking at the same risk. Both things are true, and the practical question is how to design and run a matrix so that it does the first job without the second set of failures.
This guide answers that question. It covers what a matrix is for and the three jobs it should not be given, the choice between 3×3, 4×4 and 5×5, how to write likelihood and impact anchors so that two people read them the same way, why likelihood times impact on ordinal scales is not arithmetic and what to use instead, the coloring rules that follow from Tony Cox’s 2008 analysis, inherent versus residual ratings and the control-effectiveness step between them, calibration and inter-rater testing, the known biases and how to counter them, when to abandon the matrix for ranges or a quantitative model, how internal audit uses the matrix at three altitudes, and a worked example of a drinks distributor rebuilding the matrix behind its audit plan. It complements the annual risk assessment, risk register and finding severity guides, which all assume a matrix exists and is sound.
In this guide
- What a matrix does, and three things it should not do
- 3×3, 4×4 or 5×5
- Writing the likelihood scale
- Writing the impact scale
- Why likelihood × impact is not arithmetic
- What Cox showed, and the coloring rules that follow
- Inherent, residual and the control-effectiveness step
- Known biases and the counters
- Calibration: making two raters agree
- When to leave the matrix behind
- How internal audit uses the matrix at three altitudes
- Template: a 5×5 matrix with anchors and a decision table
- Worked example: MidState Beverage rebuilds its matrix
- Questions about risk matrices
- Related guides
What a matrix does, and three things it should not do
A matrix is a screening and communication device. It sorts a long list of risks into a small number of bands so that attention can go to the top band first, and it shows a board the shape of the portfolio on one page. IEC 31010:2019, the risk assessment techniques standard that accompanies ISO 31000, lists the consequence/likelihood matrix among its techniques for exactly these uses and is candid about its limits. Three jobs it should not be given: deciding between two risks in adjacent cells (the matrix cannot tell them apart reliably); computing an aggregate exposure by adding or averaging scores (ordinal scores do not add); and justifying the size of a capital, insurance or budget decision (that needs a number, not a color). Programs that respect these limits get a tool that works; programs that use the matrix as a calculator get the failures described below.
3×3, 4×4 or 5×5
| Grid | Best for | Strengths | Weaknesses |
|---|---|---|---|
| 3×3 | Small organizations; first-pass screening of a long list; workshops with non-specialists | Fast; hard to misread; little false precision | Coarse: most risks land in the middle; cannot support an audit plan of more than a few dozen entities |
| 4×4 | Teams that want to defeat the pull to the middle | No center cell, so raters must lean one way | Less familiar; harder to map to five-point register scales used elsewhere |
| 5×5 | Risk registers, RCSAs, audit universes, finding severity; the default in most frameworks | Enough resolution to separate a 200-entity universe into usable bands; matches the five-point anchored scales most register and RCSA tools use | Centering bias on 3; false confidence that 25 cells means 25 distinguishable levels |
| Larger (6×6, 7×7, 10×10) | Rarely justified | None that a quantitative method would not deliver better | Precision the inputs cannot support; raters cannot distinguish adjacent anchors |
The 5×5 is the right default for an audit function because the annual risk assessment, the register and the RCSA all run on five-point anchored scales and the matrix should share them. The 3×3 is right for an organization of a few hundred people with a register of thirty risks. The decision is less important than the anchors: a well-anchored 3×3 beats a vague 5×5 every time.
Writing the likelihood scale
Four decisions make or break the likelihood axis. First, the time horizon: likelihood of what happening over what period? A risk that is “likely” over ten years is “rare” over one; the scale must state the horizon (usually one year for registers and audit planning, the engagement period for finding severity). Second, the unit: probability that the event occurs at least once in the period, or expected frequency per period? Both work; mixing them does not. Third, bands that are roughly an order of magnitude apart, so that a step up the scale means a real change in exposure rather than a change in a rater’s mood. Fourth, words and numbers together, because the same word means different things to different people (studies of verbal probability expressions consistently find wide spreads in the probability people attach to “likely” or “possible”), and a number alone invites false precision.
| Score | Label | Probability in the next 12 months | Frequency equivalent | Observable anchor |
|---|---|---|---|---|
| 5 | Almost certain | Above 90 percent | Expected more than once a year | Has happened in the last year, or the control that would prevent it does not exist |
| 4 | Likely | 50 to 90 percent | About once a year to once in two years | Has happened in the last three years here or at a close peer |
| 3 | Possible | 10 to 50 percent | Once in two to ten years | Has happened in the industry; plausible chain of events here |
| 2 | Unlikely | 2 to 10 percent | Once in ten to fifty years | Rare in the industry; would need several things to fail together |
| 1 | Rare | Below 2 percent | Less than once in fifty years | No known instance in the industry; conceivable only in theory |
The observable anchor column is the one raters actually use. “Has happened in the last three years here or at a peer” is a question with an answer; “likely” is an invitation to argue. For finding severity the horizon changes to the period under audit and the anchors become statements about the control: the severity guide gives that version.
Writing the impact scale
Impact needs more than one dimension, because a risk can be trivial financially and serious for safety or regulatory standing. Most organizations use four to six dimensions (financial, operational, customer, regulatory and legal, reputational, health and safety) and rate on the highest-scoring dimension rather than an average, since a risk that kills someone is a 5 whatever it costs. Each dimension needs anchors at every level, and the financial anchors need to be scaled to the organization: 5 might be a loss above 5 percent of revenue or above a stated share of pre-tax profit; 1 might be below 0.1 percent. Ratios travel better than absolute amounts because a subsidiary and a group can share the ratios while using different dollar figures. Two further decisions: whether impact means the expected consequence if the event occurs or the credible worst case (most programs use a “reasonably foreseeable” consequence and reserve worst case for scenario analysis), and whether reputational impact is a dimension or an effect of the others (the taxonomy guide argues for a dimension).
| Score | Financial | Operational | Regulatory and legal | Customer and reputation | Health and safety |
|---|---|---|---|---|---|
| 5 Severe | Above 5 percent of annual revenue, or threatens covenants or going concern | Loss of a critical process for more than the maximum tolerable outage; recovery in months | License at risk; enforcement with public findings; criminal exposure | Sustained national coverage; loss of a top customer or market | Fatality or multiple serious injuries |
| 4 Major | 1 to 5 percent of revenue | Critical process down beyond its recovery objective; recovery in weeks | Formal regulatory action; material fine | Regional coverage; measurable customer loss | Serious injury with permanent effect |
| 3 Moderate | 0.2 to 1 percent of revenue | Disruption within recovery objectives; recovery in days | Reportable breach; regulator inquiry | Complaints spike; trade press coverage | Injury requiring medical treatment and lost time |
| 2 Minor | 0.05 to 0.2 percent of revenue | Local disruption absorbed by workarounds | Technical breach, no reporting | Individual complaints; no coverage | First-aid injury |
| 1 Insignificant | Below 0.05 percent of revenue | No noticeable disruption | None | None | None |
Why likelihood × impact is not arithmetic
Many matrices compute a score by multiplying the two ratings: 4 × 3 = 12, and 12 is “High”. The ratings are ordinal numbers, labels for ordered categories, and multiplying them produces a number that looks meaningful and is not. A likelihood of 4 is not twice a likelihood of 2 (in the scale above it is roughly ten times), and an impact of 4 is not twice an impact of 2 (roughly twenty times). The product of two labels tells you nothing about the product of the quantities they stand for; two risks with the same product can differ in expected loss by a factor of fifty, and a risk scoring 10 can be larger than one scoring 12. Douglas Hubbard and others have called the compression of wide underlying ranges into a few scores range compression, and it is the mechanism behind most ranking errors. Three fixes, in rising order of rigor: use a lookup table in which each cell’s band is decided explicitly rather than computed (the template below does this); make the scales roughly logarithmic so that the product is at least monotonic in expected loss; or replace the scores with ranges and compute expected loss directly, which the quantitative section covers.
What Cox showed, and the coloring rules that follow
The reference paper is Louis Anthony Cox Jr., “What’s Wrong with Risk Matrices?”, published in Risk Analysis in 2008. Cox asked what a matrix would have to look like to be logically consistent with the quantitative risks it represents, and proposed three conditions: weak consistency (every risk in a red cell should be quantitatively larger than every risk in a green cell), betweenness (a small increase in likelihood or impact should not move a risk from green straight to red without passing through an intermediate color) and consistent coloring (cells representing roughly equal quantitative risk should get the same color). He then showed that these conditions constrain the design severely: a matrix that satisfies them can use only a few colors (three in the 5×5 case), the cells in the lowest row and leftmost column cannot be red, and the color boundaries must follow the curved iso-risk contours rather than the straight diagonals most matrices draw. He also documented four practical consequences of ignoring the conditions: poor resolution (a matrix can correctly order only a fraction of random pairs of risks), ranking errors (a smaller risk in a redder cell), suboptimal resource allocation and ambiguous inputs. Later work extended the critique: Thomas, Bratvold and Bickel (2014) catalogued further flaws including ranking reversal (the order of two risks can flip when the scale labels change) and centering bias, and Ball and Watt (2013) found that experienced users rating the same hazards on the same matrix produced widely different placements.
| Design rule | Reason | What it looks like |
|---|---|---|
| Three colors, not four or five | Cox’s conditions cannot be met with more in a 5×5 | Green, amber, red; a fourth tier if needed comes from the decision table, not from a color |
| Bottom row and left column never red | Weak consistency: a rare or insignificant risk cannot exceed every green risk | Red confined to the upper-right region; the (5,1) and (1,5) cells are amber at most |
| Boundaries follow iso-risk curves | Equal likelihood × impact products trace hyperbolas, not diagonals | The red region is a rounded corner; amber is a band following it |
| Logarithmic scales | Makes the cell ordering roughly monotonic in expected loss | Likelihood bands a factor of five to ten apart; impact bands similar |
| Decision table, not product | Ordinal products are not meaningful | Each cell assigned a band and a required response by explicit decision |
| Adjacent cells are not a ranking | Resolution is too poor to order them | Reports rank by band, then by judgment within the band, and say so |
Inherent, residual and the control-effectiveness step
Inherent risk is the rating before controls are considered; residual is the rating after. The gap between them is the claimed effect of controls, and the matrix is only as sound as that claim. Three rules keep it honest. Rate inherent against a stated baseline (“no controls” is unrealistic for most risks; “the controls any organization of this type would have” is the usual compromise, and the choice must be written down). Rate control effectiveness separately, on its own three- or four-point scale with evidence (tested effective, designed but untested, known gaps, absent), and let the residual rating follow from inherent and effectiveness by a rule rather than being chosen freely; a residual rating that is simply the inherent rating minus two because the owner feels good about the controls is the single most common corruption of a register. And record the reasoning: the risk and control matrix is where the inherent-control-residual chain is documented for a process, and the design versus operating effectiveness guide gives the evidence standards for the effectiveness rating. Some programs add a third dimension, velocity (how fast the impact arrives) or persistence, used as a tie-breaker inside a band rather than as a third axis of the grid.
Known biases and the counters
| Bias | How it shows in a matrix | Counter |
|---|---|---|
| Centering | Most risks rated 3 on both axes; the middle cell is crowded | Observable anchors; a 4×4 for workshops; ask raters to justify every 3 |
| Availability | Last year’s incident rated 5 likelihood regardless of fixes; risks never experienced rated 1 | Anchors that reference peers and the industry, not just own history |
| Anchoring on the prior year | Ratings copied forward; the register never moves | Blind re-rating before the prior year is revealed; challenge every unchanged rating |
| Ownership optimism | Owners rate their own residual risk low | Second-line challenge; internal audit’s independent view; effectiveness rated on evidence |
| Impact-likelihood conflation | A catastrophic but rare risk rated high on likelihood “because it matters” | Rate the axes separately and in a fixed order; keep worst case out of the likelihood discussion |
| Scale drift | Different units use the same labels for different magnitudes | Ratio-based financial anchors; one published scale; calibration sessions |
| Reporting pressure | Ratings adjusted so that nothing lands in red before the board meeting | Ratings owned by risk owners and challenged by the second line; changes logged with reasons |
Calibration: making two raters agree
A matrix is calibrated when two competent raters, given the same risk and the same information, place it in the same cell most of the time, and when the cells correspond to real differences in exposure. Four practices get there. Reference risks: a set of ten to fifteen risks with agreed ratings, published with the scale, that raters compare new risks against (“is this more or less likely than the fleet accident risk we rated 3?”). Calibration sessions: before an RCSA or annual assessment, the raters rate the reference set independently, compare, and resolve differences by tightening anchors rather than by averaging. An inter-rater test: twenty risks rated independently by three people; agreement on both axes within one point should exceed 80 percent, and systematic disagreements point to a weak anchor. And back-testing: at year end, compare the year’s actual incidents and losses with the ratings they were given; a risk rated “rare” that happened twice, or a “severe” that cost a tenth of the anchor, is evidence against the scale or the rater. The probability models guide shows how a function with loss data can test likelihood bands against observed frequencies.
When to leave the matrix behind
| Situation | Why the matrix fails | Use instead |
|---|---|---|
| Deciding a capital buffer, insurance limit or control investment | Needs a magnitude; a color is not one | Expected loss and loss distribution: ranges for frequency and severity, combined by simulation (Monte Carlo) |
| Comparing two risks in the same band | Resolution too poor | Explicit ranges and a side-by-side of expected and tail loss |
| Cyber and technology risk with many scenarios | Scenario count overwhelms the grid; losses span orders of magnitude | A factor model such as Open FAIR, which decomposes frequency and magnitude into estimable parts |
| Aggregating risks across units | Ordinal scores do not add | Loss distributions aggregated with correlation assumptions, or at minimum counts by band |
| Financial risks with market data | The data support real measurement | Value at risk, expected shortfall, sensitivity measures (VaR guide) |
| Screening a long list for a board | Does not fail | Keep the matrix |
The move from matrix to ranges is smaller than it sounds. Replacing “likelihood 3” with “between one in ten and one in two per year” and “impact 4” with “between $2 million and $10 million” and multiplying the ranges gives an expected-loss range that is defensible, comparable and still produced by the same experts in the same workshop. The matrix can then be drawn from the ranges rather than the other way round, which removes most of Cox’s objections at the cost of twenty minutes of extra thought per risk.
How internal audit uses the matrix at three altitudes
Internal audit meets the matrix at three altitudes and should use the same scales at all three. At the universe level, the annual risk assessment scores auditable entities on weighted factors and the matrix places them in bands that drive the plan; here the failure to watch is a universe in which 60 percent of entities land in the middle band, which gives the plan no signal, and the counter is the calibration work above plus the risk-based prioritization described in that guide. At the engagement level, the risk and control matrix rates each process risk inherent and residual to decide what to test and how much (the sample size guide ties residual risk to sample sizes). At the finding level, the severity grid places each finding by impact and likelihood to set the rating and the escalation; the high versus low risk issues guide explains why the response differs by band. One more use: the function tests management’s matrix as part of a risk framework audit, where the inter-rater test and the back-test above are the two procedures that find a decorative matrix.
Template: a 5×5 matrix with anchors and a decision table
The grid below applies the coloring rules: three bands, no red in the bottom row or left column, a rounded red region and amber following it. Cells show the band; the decision table states what each band requires. Likelihood runs down the rows (5 at the top), impact across the columns (1 at the left).
| Likelihood ↓ / Impact → | 1 Insignificant | 2 Minor | 3 Moderate | 4 Major | 5 Severe |
|---|---|---|---|---|---|
| 5 Almost certain | Green | Amber | Amber | Red | Red |
| 4 Likely | Green | Amber | Amber | Red | Red |
| 3 Possible | Green | Green | Amber | Amber | Red |
| 2 Unlikely | Green | Green | Green | Amber | Amber |
| 1 Rare | Green | Green | Green | Green | Amber |
| Band | Meaning | Required response | Audit planning use | Finding severity equivalent |
|---|---|---|---|---|
| Red | Outside appetite or close to it; needs executive attention | Named executive owner; treatment plan with dates; reported to the risk committee and board each cycle | Entity audited every cycle or continuously monitored | High or Critical, per the escalation rules |
| Amber | Within appetite but material; needs management attention | Risk owner; controls confirmed; KRI monitored; reviewed quarterly | Entity audited every two to three years | Medium |
| Green | Accepted at current levels | Owner confirms annually; no treatment required | Entity audited on rotation or by exception | Low |
Scale note to accompany the grid: Likelihood is the probability of at least one occurrence in the next twelve months, rated against the observable anchors in the likelihood table. Impact is the reasonably foreseeable consequence if the event occurs, rated on the highest-scoring dimension. Inherent ratings assume the controls any organization of our type would operate; residual ratings follow from inherent and the evidenced control-effectiveness rating by the published rule. Bands are assigned by this grid, not by multiplying scores. Risks within a band are not ranked by the grid; rankings within a band are judgments and are labeled as such. Scale version [2.0, approved by the risk committee on date]; reference risk set attached.
Worked example: MidState Beverage rebuilds its matrix
MidState Beverage is a three-state drinks distributor with twelve depots, about 1,400 employees, $221 million in revenue and a six-person internal audit function, used in examples across this site. Its FY27 audit plan was built on a 5×5 matrix inherited from a consultant’s template: likelihood labels without probabilities or horizon, financial impact anchors in absolute dollars that had not changed since the company was half its size, four colors, a straight diagonal boundary, and a score computed as likelihood times impact. The chief audit executive noticed the problem when two senior auditors, rating the universe independently as a quality check, placed 23 of the 61 auditable entities in different color bands, and when the plan’s “red” list included the depot vending program (score 12: likelihood 4 × impact 3, with impact anchored at a dollar figure that was now 0.3 percent of revenue) above route cash (score 10: likelihood 2 × impact 5), the single process through which $31 million in cash moves each year.
The rebuild took the function about 40 hours over six weeks, with the finance director as the business counterpart. Likelihood was redefined as the probability of at least one occurrence in twelve months with the observable anchors above; impact was rewritten with ratio-based financial anchors (5 above 5 percent of revenue, about $11 million; 3 between 0.2 and 1 percent, about $440,000 to $2.2 million) and dimensions for operations, regulatory (state alcohol licensing), customer and safety (300 route drivers). The colors went from four to three, the boundary from a diagonal to the rounded region in the template, and the computed score was replaced by the grid. A reference set of twelve entities was rated jointly and published. The two auditors then re-rated the universe blind: disagreements by band fell from 23 to 4, and all four were resolved by tightening two impact anchors. Route cash moved to red (likelihood 3 after the FY27 engagement’s findings on depot reconciliations, impact 5 on the regulatory dimension given licensing exposure); the vending program moved to amber; the middle band shrank from 38 entities to 21, which gave the plan room to differentiate.
| Element | Before | After |
|---|---|---|
| Likelihood scale | Labels only; no horizon | Probability in 12 months with frequency and observable anchors |
| Impact scale | Absolute dollars from an earlier era; financial only in practice | Ratio-based financial anchors plus four other dimensions; highest dimension governs |
| Colors and boundary | Four colors; straight diagonal; (5,1) cell red | Three colors; rounded red region; bottom row and left column never red |
| Score | Likelihood × impact | Grid lookup; decision table by band |
| Inter-rater disagreement (61 entities, by band) | 23 | 4, then 0 after two anchor fixes |
| Middle band | 38 entities | 21 entities |
| Route cash | Score 10, amber, below vending | Red; audited every cycle |
| Governance | None; template never reviewed | Scale version 2.0 approved by the audit committee for audit planning; reference set; annual back-test against incidents |
The audit committee’s question, when the revised plan was presented, was whether the function had simply moved the risks it wanted to audit into red. The CAE’s answer was the blind re-rating result and the published anchors, which is the point of the whole exercise: a matrix that two people apply the same way can be defended; one that cannot is a drawing.
Questions about risk matrices
Is a 5×5 risk matrix better than a 3×3?
It has more resolution, which an audit universe or a large register needs, but it is only better if the anchors are precise enough to use the extra cells. A small organization with a thirty-risk register is usually better served by a well-anchored 3×3.
Should I multiply likelihood by impact?
No. The ratings are ordinal labels and their product has no quantitative meaning; it can rank a smaller risk above a larger one. Assign each cell a band by explicit decision, or move to ranges and compute expected loss properly.
How many colors should a risk matrix have?
Three. Cox’s 2008 analysis showed that a 5×5 matrix cannot satisfy basic consistency conditions with more, and that red should never appear in the bottom row or left column.
What is the difference between inherent and residual risk on a matrix?
Inherent is the rating before the specific controls are credited, against a stated baseline; residual is after. The residual rating should follow from the inherent rating and an evidenced control-effectiveness rating by a published rule, not be chosen freely.
How do I know whether my matrix is calibrated?
Have three people rate twenty risks independently; agreement within one point on each axis should exceed 80 percent. Then compare the year’s actual incidents with the ratings they were given. Disagreements and surprises point to the anchors that need work.
When should I use a quantitative method instead?
Whenever the decision needs a magnitude: a capital buffer, an insurance limit, a control investment, or a comparison between two risks in the same band. Ranges for frequency and severity, combined by simulation, are a modest step up from the matrix and answer those questions.
Does internal audit use the same matrix as management?
It should use the same scales, so that the audit plan, the register and the findings speak one language, while forming its own independent ratings. Where management’s matrix is unsound, internal audit says so as a finding and uses a sound one for its own planning.
Related guides
- The annual internal audit risk assessment — the five-factor model the matrix feeds.
- The risk register — five-point anchored scales at register altitude.
- Finding severity ratings — the grid applied to findings, with escalation rules.
- How to run an RCSA — scoring discipline in self-assessments.
- Risk appetite statements — the tolerances the bands map to.
- Risk and control matrix template — inherent, control, residual for a process.
- Test of design versus operating effectiveness — evidence for the control-effectiveness rating.
- Risk-based auditing 101 — turning bands into a plan.
- Building the audit plan — coverage by band.
- Audit sample sizes — residual risk to sample size.
- High-risk versus low-risk issues — why the response differs by band.
- Probability models for internal audit — testing likelihood bands against data.
- Value at risk — the quantitative alternative for market risk.
- Audit risk: the definitive guide — the other meaning of risk in audit.
- Risk management frameworks compared — COSO ERM and ISO 31000 on assessment.
- Risk taxonomy — the categories the matrix rates.
- Engagement Risk Assessment: From Process to Test Plan — scoping a single audit from risks to procedures, with a worked example
- Compliance Risk Assessment: Method, Scoring, Worked Example — obligations inventory, exposure scoring and prioritization that regulators accept
Leave a Reply