List your risks, score each for likelihood and impact from 1 to 5, and see them on a 5×5 heat map. Risk score is likelihood times impact. Download the register as Excel.
Bands used: Low 1 to 4, Medium 5 to 9, High 10 to 19, Critical 20 to 25. These are a common convention, not a standard. Use the bands in your own risk policy.
A risk matrix ranks risks by how likely they are and how much they would hurt. Multiplying the two scores gives a number you can sort and compare. Define each point on the scale in writing, for example what a 4 for impact means in rupees or in service downtime, so different people score consistently. A matrix is a prioritisation aid, not a measurement of risk.
Each risk gets two scores from 1 to 5: how likely it is to happen, and how serious the impact would be if it did. The risk score is the product of the two, so it runs from 1 to 25. The heat map shows where your risks cluster, and the ranked list shows which to deal with first.
The rating bands on this page, Low, Medium, High and Critical, are a common convention. Your own policy may use different cut-offs, and you should apply those if so.
Good scoring needs written scale definitions. Without them, one person's 4 is another person's 2, and the ranking means little.
A finance team scores three risks: a key vendor failing, duplicate payments, and a data breach.
