The Risk Assessment Matrix Explained

Whether you are preparing for an ISO 27001 audit or building out your obligations under NIS2 and DORA, sooner or later someone asks the same question: how do you decide which risks matter most? The answer that auditors, boards and regulators recognise is a simple grid. A risk assessment matrix turns a long list of threats into a ranked picture of what to fix first, and it sits at the heart of the frameworks that now govern critical sectors, including NIS2, DORA and ISO 27001.

This guide explains what a risk matrix is, how the likelihood and impact scales work, and how to score and read a 5×5 grid without guessing. We also walk through how to build your own, share a ready-to-use template structure you can copy, and flag the mistakes that quietly make a matrix unreliable. By the end you will be able to build and defend your scoring to an auditor.

What is a risk assessment matrix

A risk assessment matrix, sometimes called a risk matrix or risk management matrix, is a visual grid that scores each risk on two axes: how likely it is to happen and how badly it would hurt if it did. Plotting risks this way replaces vague debate with a shared, comparable score, so a data breach and a supplier outage can be ranked on the same scale.

The point is prioritisation. Most organisations have far more risks than time or budget to treat, so the matrix concentrates attention on the events that can do the most damage. It also gives everyone the same language: when a board, an IT team and an auditor all read the same grid, the mitigation conversation starts from agreement rather than opinion.

The likelihood and impact scales

Every matrix rests on two scales, and they only work if everyone applies them the same way. Vague labels like low and high invite inconsistent scoring, so each level should have a clear, written definition tied to your context. A common 5×5 likelihood scale runs from rare to almost certain:

• Rare (1): the event is highly unlikely, perhaps once in a decade.
• Unlikely (2): it could happen, but only every few years.
• Possible (3): a realistic chance within the next year or two.
• Likely (4): expected to occur several times a year.
• Almost certain (5): effectively continuous or recurring.

Impact (also called severity or consequence) uses the same five-point structure, but measured in outcomes that matter to your organisation: financial loss, downtime, safety, reputation or regulatory penalty. A typical impact scale looks like this:

• Insignificant (1): negligible effect, easily absorbed.
• Minor (2): limited disruption, quickly managed.
• Moderate (3): noticeable impact that takes real effort to recover from.
• Major (4): significant, possibly long-lasting damage.
• Catastrophic (5): severe harm the organisation may struggle to recover from.

How to score and read the matrix

Scoring is deliberately simple. Multiply the likelihood level by the impact level, and you get a risk score between 1 and 25. The formula is Likelihood x Impact, so a phishing risk rated Possible (3) for likelihood and Major (4) for impact scores 12.

That number means nothing on its own, which is why the grid is colour-coded into action bands. The exact cut-offs reflect your organisation’s risk appetite, but a widely used set of thresholds for a 5×5 matrix maps each score to a level and a required response, as shown below.

Two risks can share a score for very different reasons, so the band is a starting point, not the final word. A rare but catastrophic event (1 x 5 = 5) and a frequent but minor one (5 x 1 = 5) both land at 5, yet they call for different responses. Always read the score alongside the two underlying ratings.

A risk matrix does not remove judgement. It makes judgement visible, consistent and easy to challenge.

How to build your matrix

Building a usable matrix takes five practical steps, and the structure matters more than the software. You can run it in a spreadsheet or in a compliance platform; what counts is that the scales and thresholds are documented and repeatable.

1. Define your scales. Write clear descriptions for each likelihood and impact level so any assessor reaches the same score.
2. Set your thresholds. Decide which score ranges count as low, medium, high and critical, based on your risk appetite.
3. Identify and score risks. For each risk, agree a likelihood and an impact rating, then multiply to get the score.
4. Record inherent and residual. Score before controls, then after, so the value of your controls is visible.
5. Assign owners and dates. Every risk needs a named owner and a date to be reassessed.

To turn that into a working register, your free template needs a row per risk and columns that capture the full lifecycle. At a minimum, include the fields below so the matrix doubles as audit evidence rather than a one-off slide.

• Risk ID and title: a unique reference and a short name.
• Description and category: what the risk is and where it belongs.
• Owner: the person accountable for managing it.
• Inherent likelihood and impact: the raw scores before controls.
• Controls and effectiveness: what reduces the risk and how well.
• Residual likelihood and impact: the scores once controls apply.
• Treatment decision: accept, mitigate, transfer or avoid.
• Review date: when the risk will be reassessed.

Common pitfalls to avoid

A matrix looks objective, but a few habits quietly erode its reliability. Knowing the common failure modes lets you design around them from the start.

• Optimism bias: assessors routinely under-rate the likelihood of tasks they perform every day.
• False precision: a score of 12 is not meaningfully better than 10, so use the bands, not the raw number, to drive decisions.
• Score collisions: a rare catastrophe and a frequent nuisance can land on the same number, so never rely on the score alone.
• Subjective scoring: without clear definitions, two people rate the same risk differently, so calibration exercises help.
• A static snapshot: a matrix that lives in an old slide deck is worthless, because risk is dynamic and needs regular review.

Where the matrix fits in compliance

For regulated organisations, the matrix is not optional housekeeping; it is expected evidence. Standards across information security and operational resilience require a documented, repeatable risk assessment, and the grid is the format auditors and regulators already recognise.

Under ISO 27001 you must show how risks were identified, scored and treated. NIS2 pushes essential and important entities to manage risk proportionately across their supply chains, while DORA expects financial entities to assess and monitor ICT and third-party risk on an ongoing basis. In each case, a clear matrix gives you a defensible audit trail.

This is where a spreadsheet starts to strain. As registers grow and reviews fall due, manual matrices drift out of date between audits. StartComply keeps scoring, controls and review cycles in one place, giving you real-time risk visibility instead of a snapshot, and links each risk to the controls and evidence your framework demands.