What a risk matrix is
A risk matrix is a table where each risk is rated on two scales: probability (how likely the event is) and impact (how much it hurts if it happens). Multiplying them gives the priority: red zone means act now, yellow means keep under control, green means accept.
How to build it in an hour
- List 10–15 risks (cyberattack, IT failure, loss of a supplier, loss of a key employee, etc.).
- Rate probability on a 1–3 scale (low/medium/high).
- Rate impact on a 1–3 scale (low/medium/high).
- Multiply them to get a priority from 1 to 9.
- Start with risks scored 6–9: they need mitigation measures and plans.
| Risk | Probability | Impact | Priority |
|---|---|---|---|
| Cyberattack / ransomware | 3 | 3 | 9 (red) |
| Loss of a key supplier | 2 | 3 | 6 (red) |
| Equipment failure | 2 | 2 | 4 (yellow) |
What to do with the result
For the red zone, reduce the probability (protective measures) and prepare plans in case the risk materialises (BCP). The matrix is the entry point to risk management. For processes, criticality is assessed in more depth through a BIA.
Frequently asked questions
Which scale should you choose: 3 or 5 points?
For SMEs, a 1–3 scale for probability and impact is enough. A 5-point scale is needed when you must prioritise a large number of risks more finely.
How does a risk matrix differ from a BIA?
The matrix prioritises risks by probability and impact. A BIA assesses the impact of downtime on specific processes and sets recovery times. The two are used together.
From the risk register to management decisions
Check whether your risks reach the people who make decisions. The dashboard shows the status on one screen; the turnkey system makes it work in practice.
