Risk assessment matrix and template: how to build and use one
A risk assessment matrix scores each risk by two factors: how likely it is (likelihood) and how bad it would be (impact). The two combine into a risk level, usually Low, Medium, High, or Extreme, so you can rank risks and treat the worst ones first. Below is a standard 5x5 matrix, the columns a risk assessment template should contain, and how to put both to work.
- Axes
- Likelihood x Impact
- Common grid
- 5 x 5 (25 cells)
- Score
- 1 to 25
- Levels
- Low to Extreme
What is a risk assessment matrix?
A risk assessment matrix is a grid that rates risk by combining two factors: the likelihood that an event happens and the impact, or severity, if it does. Likelihood runs along one axis, impact along the other, and each cell where they meet carries a resulting risk level. It is also called a risk matrix, a risk rating matrix, or a likelihood and impact matrix.
The point of the matrix is prioritization. Instead of treating every risk as equal, you place each one on the grid and let its position tell you how urgent it is. A rare event with a minor consequence sits in the Low band; a likely event with a severe consequence sits in the Extreme band and demands action. Because everyone scores against the same definitions, the matrix also makes risk ratings consistent across people, teams, and departments.
How probable the event is, scored on a defined scale, for example Rare, Unlikely, Possible, Likely, Almost Certain.
How severe the consequence would be, scored from Insignificant and Minor through Moderate, Major, and Severe.
The 5x5 risk assessment matrix
This is the standard 5x5 risk matrix. Read down to find the likelihood, across to find the impact, and the cell where they meet gives the risk level. The score in each cell is likelihood multiplied by impact, from 1 to 25.
| Likelihood ↓ / Impact → | Insignificant | Minor | Moderate | Major | Severe |
|---|---|---|---|---|---|
| Rare | Low1 | Low2 | Low3 | Medium4 | Medium5 |
| Unlikely | Low2 | Medium4 | Medium6 | Medium8 | High10 |
| Possible | Low3 | Medium6 | Medium9 | High12 | High15 |
| Likely | Medium4 | Medium8 | High12 | Extreme16 | Extreme20 |
| Almost Certain | Medium5 | High10 | High15 | Extreme20 | Extreme25 |
How to use the risk matrix
Using the matrix is a short, repeatable loop. Do it the same way for every risk and the ratings stay comparable across your whole register.
- 1
Score the likelihood
Decide how probable the event is and pick a level from Rare to Almost Certain. Base it on history, data, and expert judgment, not gut feel, and write down the reasoning so others can follow it.
- 2
Score the impact
Decide how severe the consequence would be if the event happened, from Insignificant to Severe. Consider the worst credible outcome across the dimensions that matter to you, such as safety, finances, operations, and reputation.
- 3
Read the risk level
Find the cell where the likelihood row meets the impact column. Its color and label, Low, Medium, High, or Extreme, is the risk level. The number in the cell is the score, likelihood multiplied by impact.
- 4
Prioritize the treatment
Sort risks by level and treat the worst first. Extreme and High risks usually need action and an owner now; Medium risks are managed and monitored; Low risks are often accepted. Re-score after controls are in place to capture the residual risk.
The risk assessment template
The matrix gives you the score; a risk assessment template gives you somewhere to record it. A good template, or sample risk assessment form, uses a consistent set of columns so every risk is captured the same way. These are the standard ones.
| Column | What it captures |
|---|---|
| Risk ID | A unique reference for each risk so it can be tracked, sorted, and reported on. |
| Hazard / Risk | A short, plain description of the risk or hazard and what could go wrong. |
| Likelihood | How probable the event is, scored on a defined scale such as Rare to Almost Certain. |
| Impact | How severe the consequence would be, scored from Insignificant to Severe. |
| Risk score | Likelihood multiplied by impact, mapped to a risk level: Low, Medium, High, or Extreme. |
| Owner | The person accountable for managing the risk and its treatment. |
| Controls | The measures already in place, or planned, to reduce the likelihood or the impact. |
| Residual risk | The risk level that remains after the controls are applied. |
| Review date | When the risk will be reassessed, so the register stays current. |
Our free risk register template ships with these columns, a 5x5 likelihood-and-impact scoring key, and a residual-risk view, so your team can start logging and scoring risks today.
Automate the matrix with RiskWatch
A matrix in a spreadsheet works until the program grows. Then version control, roll-ups across teams, audit trails, and review reminders start to slow you down. RiskWatch runs the same likelihood and impact model as a live, scored assessment: it rates each risk, places it on the matrix automatically, tracks owners and controls, and shows residual risk after treatment.
Risk assessment matrix, answered
The questions teams ask most when they start scoring risk.
What is a risk assessment matrix?
What is the difference between a 3x3 and a 5x5 risk matrix?
How do you calculate a risk score?
What is a risk assessment template?
What is a sample risk assessment form?
Run your risk matrix as a scored assessment.
Score likelihood and impact, place every risk on the matrix automatically, assign owners and controls, and track residual risk to closure. 30-day free trial, no credit card.
No credit card required · 30-day free trial · Cancel anytime