Building Risk Matrices
Visualizing likelihood and impact in a table
A risk matrix crosses likelihood and impact in a visual table, typically with three to five levels per axis, which makes it possible to place each identified risk in a specific cell and immediately communicate its relative severity compared with the rest of the organization's risk portfolio. Building a useful matrix requires defining clear, specific criteria for each level of likelihood and impact, avoiding vague descriptions such as high impact and replacing them with concrete thresholds such as a financial loss above a defined amount or an interruption of a critical process for more than a certain number of hours. In practice, the biggest risk of a poorly built matrix is the illusion of precision, because placing a complex risk in a single cell simplifies a reality with multiple variables, so it's worth complementing the matrix with a brief written justification of why each risk was placed where it was, especially for those that fall near the boundary between two severity levels.