Risk Matrix & Register
List what could go wrong, rate how likely it is and how bad it would be, and see where each risk lands on a 5×5 heatmap, before and after the controls you plan.
Last updated
Impact →
How to make a risk matrix
- Click + Add risk and rate its likelihood and impact from 1 to 5.
- Add the controls you plan and rate the risk again assuming they work.
- Switch between Before controls and After controls on the heatmap; sort, download as CSV or share.
About this tool
A risk matrix scores each risk as likelihood × impact, each on a 1–5 scale, giving a rating from 1 to 25. Ratings of 1–4 are low, 5–9 medium, 10–16 high and 20–25 critical. The heatmap shows at a glance where your biggest exposures are: the top-right corner is where attention should go first.
For each risk you can note the controls you'll put in place and rate it again assuming they work, the residual risk. Switch the heatmap to "After controls" to see whether your plan actually moves risks out of the red, or only feels like it does. Numbers on the map match the numbers in the register.
The 1–5 scales use common labels: likelihood runs from rare to almost certain, and impact from negligible to severe. What counts as "severe" depends on your context, so agree on it with anyone else using the same register. The register is saved on this device and can be exported as CSV or shared as a link. Nothing is uploaded.
Questions about risk matrices
How is a risk rating calculated?
Likelihood × impact, each from 1 to 5, giving 1 to 25. 1–4 is low, 5–9 medium, 10–16 high and 20–25 critical.
What is residual risk?
The risk left after your controls are in place. Comparing it with the original shows whether your plan really reduces it.
What is a risk register?
A list of risks with their ratings, owners and controls. The table under the heatmap is one, and downloads as a spreadsheet.
Which risks should I deal with first?
Those in the top-right of the heatmap: likely and severe.