Risk Matrix: How to Build and Read a 5×5 Without Lying to Yourself

The risk matrix is the most-used and most-abused picture in the discipline. A grid — likelihood down one side, impact across the other, risks plotted as dots in colored cells — it survives because it does one job brilliantly: it lets a room full of people see the same worry at the same time and argue about the right one. It fails when it is asked to be a measurement instrument instead of a conversation instrument. This guide covers how to build one honestly, how to read one skeptically, and where its known pathologies will mislead you if you let them.

Build the scales before you plot anything

A matrix is exactly as honest as its axis definitions. Likelihood needs frequency anchors, not adjectives: a 5 might mean “expected at least once a year,” a 3 “once in five years,” a 1 “not in twenty.” Impact needs consequence anchors in the units the organization feels — downtime measured against recovery objectives, financial bands, harm to people, regulatory exposure — with the highest band reserved for the genuinely existential, or everything migrates to red and the picture says nothing. Score impact on the worst credible case and likelihood on the planning horizon you actually manage to, usually three to five years. Write the anchors on the matrix itself; a grid whose scales live in a separate document will be reinterpreted by every reader.

Plotting: inherent, residual, and the argument between them

Plot each risk twice or admit you are plotting a feeling. Inherent position — likelihood and impact before controls — shows the exposure the organization carries by existing. Residual position — after the controls you actually operate — shows what leadership has accepted. The distance between the two dots is the value your control environment claims to produce, and it is the most informative thing on the page: a risk that barely moves between inherent and residual is either under-controlled or over-feared, and both are findings. Risks enter the matrix from the risk assessment, carrying their evidence with them; a dot without a file behind it is decoration.

The pathologies, named

Range compression: in any real register, most risks crowd into the middle cells, because assessors avoid extremes — the matrix then displays a reassuring yellow-green sea while the two risks that matter hide in it. Counter it with forced ranking: the matrix starts the argument, the ranked list ends it. Ordinal math: multiplying likelihood 3 by impact 4 to produce “12” treats labels as quantities; two risks scoring 12 can differ by an order of magnitude in expected loss, and ties broken by arithmetic are decisions made by accident. Use scores for sorting, never for sums. The corner-equivalence mirage: coloring schemes paint high-likelihood/low-impact and low-likelihood/high-impact cells as equivalent heat, but they demand opposite responses — the first is an efficiency problem, the second is the catastrophe you bought continuity planning for. Read the corners differently, because they are different.

What the matrix is for — and what replaces it when it is not enough

The matrix is a triage picture. It decides what gets discussed, funded, and escalated; the working detail lives in the risk register, where each risk’s owner, treatment, and review date sit. Where decisions carry real money — capital allocation, insurance limits, a board asking “how bad is bad” — graduate the top risks to scenario analysis: named events with estimated loss ranges, the method this hub carries in its threat analysis guide. Matrix for the room, register for the work, scenarios for the money. Each tool at its own job is a system; any one of them at all three jobs is a liability.

Frequently asked questions

What is a risk matrix?

A grid that plots risks by likelihood against impact, usually on five-point anchored scales, to triage which risks get attention first. It is a communication and prioritization tool — the output of a risk assessment, not a substitute for one.

What size matrix should we use — 3×3, 4×4, or 5×5?

Five-by-five is the working standard: fine enough to separate the crowd in the middle, coarse enough to stay honest about precision. Smaller grids force false ties; larger ones pretend to measurement accuracy the underlying judgments do not have.

Why do risk matrices get criticized?

Because they are often used as measurement instead of triage: ordinal scores get multiplied into false precision, assessors compress everything into the middle, and color bands equate frequent small losses with rare catastrophes. Built on anchored scales and used to start arguments rather than settle them, the tool earns its place.

Should we plot inherent or residual risk?

Both. Inherent risk shows the exposure before controls; residual shows what remains after the controls you actually operate. The gap between the two is your control environment’s claimed value — and the first thing an auditor or board should question.

Updated 2026-10-31: citation-QC refresh — unsupported claims tightened to sources.

Updated Nov 1, 2026 — added the free honest 5×5 quick card, honest 5×5 pack, and risk matrix mentor downloads to this guide.