What it is
A heat map shows where risks cluster. This workbook scores each risk for likelihood and impact before and after controls, rates it from your thresholds and plots both positions on 5 by 5 grids that count the risks in each cell.
The grid colors follow the thresholds you enter, and the scales are described in your own words so that every scorer reads them the same way.
When to use it
- When building or refreshing an enterprise or process risk register.
- To present risks to the audit committee or board.
- To show the effect of controls by comparing inherent and residual positions.
What’s inside
- Parameters with thresholds and scale descriptions
- Register of 40 risks with inherent and residual scoring and response
- Two 5 by 5 heat maps with counts and color bands
- Checks for residual above inherent and high residual accepted
Standard cited
This template follows COSO ERM / risk assessment. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What is the difference between inherent and residual risk?
Inherent risk is the risk before considering the controls. Residual risk is what remains after controls that actually operate. Score residual from tested or observed controls, not from the design alone.
Does a middle score mean a risk can be ignored?
No. A low-likelihood event with a severe impact can deserve attention even when the score is in the middle. The heat map is an aid to judgment, not a replacement for it.
Related templates
- Risk Register
- Internal Audit Universe Risk Scoring
- Fraud Risk Assessment Worksheet
- COSO 17 Principles Assessment
Last updated 11/05/2026. All free templates.