A risk assessment matrix is a grid that scores each risk on two scales, how likely it is and how bad it would be, then multiplies them into one rating. The grid is only as good as its scale definitions: agree what each number means before anyone scores a single risk. Most teams use a 5 by 5 grid, giving scores from 1 to 25.
Last reviewed: 17 October 2026. Facts checked. We searched for how risk matrices are built and found consistent guidance on 1 to 5 scales, multiplying the two scores, and defining each level in advance. One public-sector guide asks assessors to score with existing controls in mind. Sources differ on where the rating bands start, so the cut-offs below are examples to adapt. We did not open ISO 31000 or any standard directly.
How the matrix works
Likelihood goes on one axis and impact on the other. Each runs from 1 to 5. The score is likelihood multiplied by impact. A risk that is almost certain (5) and catastrophic (5) scores 25. A risk that is rare (1) and minor (1) scores 1.
The colour bands then tell people what to do. The matrix does not predict anything. It puts risks in order so the team can decide where to act first.
Step 1: Define the likelihood scale
Words alone cause arguments. Add a rough frequency to each level.
| Score | Label | Example meaning |
|---|---|---|
| 1 | Rare | Not expected in the next three years |
| 2 | Unlikely | Could happen once in two to three years |
| 3 | Possible | Could happen once a year |
| 4 | Likely | Expected several times a year |
| 5 | Almost certain | Happens monthly or is already happening |
These frequencies are examples. Change them to fit your business, then keep them fixed.
Step 2: Define the impact scale
Impact should be described in money, in operations, in compliance and in reputation, so that different risks can be scored on the same scale. The rupee limits must come from your own size. A figure that is serious for a small firm may be trivial for a large one.
| Score | Label | Money | Operations | Compliance | Reputation |
|---|---|---|---|---|---|
| 1 | Minor | Below your lowest limit | Minor delay | No notice | No outside notice |
| 2 | Moderate | Small, absorbed in budget | Delay of days | Internal exception | Complaint from one customer |
| 3 | Significant | Needs approval to absorb | Process stopped for a week | Notice from a regulator | Local press or key client concern |
| 4 | Major | Hits the quarter's profit | Site or system down for weeks | Penalty or prosecution risk | National press, lost client |
| 5 | Severe | Threatens going concern | Business cannot operate | Licence or director liability | Lasting loss of trust |
Set the rupee column yourself, as a fraction of revenue or profit, and have the finance head sign it off.
Step 3: Set the rating bands
Common practice is to split the 25 cells into three or four bands. Sources differ on the exact cut-offs, so treat these as a starting point.
| Score | Band | Typical response |
|---|---|---|
| 1 to 4 | Low | Accept and watch |
| 5 to 9 | Medium | Manage within the team, review every quarter |
| 10 to 14 | High | Action plan and owner; report to management |
| 15 to 25 | Critical | Senior attention now; report to the audit committee |
The bands are where you express your risk appetite: the level of risk the business is willing to carry. Write down the score at which action becomes mandatory.
A worked example
Take "payroll paid to an employee who has left". The HR head thinks it is possible (3) and significant in rupee terms but small in reputation, so impact is 2. Score: 3 x 2 = 6, a medium rating.
Now add facts. An audit finds that exit forms reach payroll late in many months, and some payments have already gone out. Likelihood moves to 4. The impact is still 2. Score: 4 x 2 = 8, still medium, but the team now has evidence, not opinion. If the monthly amounts are large, the impact score should be reviewed too. The point is that scores change when evidence changes, and the file should show why.
Inherent versus residual
Score a risk twice. Inherent is before controls. Residual is after the controls you actually have working. Some teams score only residual, and that is acceptable if you say so. What matters is consistency, so everyone scores the same way. Our risk register guide shows both scores side by side.
Common mistakes
- Scoring by mood. Two people reading the same words give different numbers. Use written scale definitions and score in a group.
- Everything is medium. If most risks land in the middle, your scales are too vague or people are avoiding extremes.
- Treating the product as exact. A 12 from 4 x 3 and a 12 from 2 x 6 are different risks. A rare, catastrophic risk deserves attention even at a low product. Look at impact separately for the severe cases.
- Never changing the scale. Revisit the rupee thresholds when the business grows.
- No link to action. Every band needs a response, or the colours are decoration.
Using the matrix in internal audit
Internal audit uses the matrix to rank auditable areas for the annual plan, and again to rate each finding. For the planning side, see how to build an audit universe. For reporting, our audit risk scorer framework shows how scoring flows into the audit plan.
You can try the scoring on our internal audit risk scorer, and find a ready grid in the internal audit risk assessment matrix template. For rating findings after fieldwork, use the issue rating matrix generator.
Frequently Asked Questions
What is a risk assessment matrix?
It is a grid that rates risks by likelihood and impact. Multiplying the two scores gives a rating that helps you decide which risks need action first.
Should I use a 3x3, 4x4 or 5x5 matrix?
A 5 by 5 gives finer ranking and is the most common choice. A 3 by 3 is simpler for small teams. What matters more than size is that each level has a written definition.
What is a good cut-off for a high risk?
There is no universal figure. Sources vary, and some flag scores above about 12 to 15 as high. Choose your own cut-off based on your risk appetite and write it down.
What is the difference between inherent and residual risk?
Inherent risk is the level before controls. Residual risk is what remains after the controls you have in place. Residual should always be equal to or lower than inherent.
Can the same matrix be used for fraud, IT and compliance risks?
Yes, if the impact scale covers money, operations, compliance and reputation. That lets you compare different types of risk on the same grid.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error