Overview
The most widely used tool for communicating risk is the qualitative risk matrix — a simple grid of likelihood against impact. It is popular because it turns fuzzy judgments into a shared, visual ranking that non-specialists can grasp at a glance. This lesson shows how to build and read one, and its limits.
Learning objectives
- Construct a qualitative risk matrix.
- Use it to prioritize risks.
- Recognize the weaknesses of matrices.
Core concept
A risk matrix places likelihood on one axis and impact on the other, each divided into bands (commonly 3×3 or 5×5). Each cell represents a risk level — often colored green (low), yellow (medium), and red (high) — so a risk's position instantly signals how urgent it is.
| Likelihood ↓ / Impact → | Minor | Moderate | Severe |
|---|---|---|---|
| Likely | Medium | High | High |
| Possible | Low | Medium | High |
| Unlikely | Low | Low | Medium |
You plot each identified risk into the grid, then treat the red cells first, yellow next, and monitor green.
How it works
The workflow: for each risk, assign a likelihood band and an impact band, find the intersecting cell, and read off the risk level. Sorting risks by cell color produces a defensible priority order and a one-page picture that executives can act on. The bands and colors are defined in advance so ratings stay consistent across assessors.
Practical example
Two risks: "ransomware on the file server" is rated Likely × Severe → lands in a red cell → treat immediately. "Defacement of an old internal test page" is rated Unlikely × Minor → green cell → monitor. Placed side by side on the matrix, the priority is obvious to a manager who has never read a CVSS score.
Cybersecurity relevance
Risk matrices appear in nearly every security report and steering meeting because they communicate priority without jargon. They are the bridge between technical findings and business decisions.
Common mistakes
- False precision: colors and bands feel objective but rest on subjective estimates; two assessors may rate the same risk differently.
- Compressing very different risks into the same cell, hiding meaningful differences.
- Treating the matrix as the analysis rather than a summary of it — the thinking behind each rating is what matters.
Key takeaways
- A qualitative risk matrix maps likelihood against impact to rank and communicate risks.
- It is prized for turning judgments into a clear, shared, visual priority.
- Its ratings are subjective, so use it as a communication summary, not a substitute for careful analysis.
Check your understanding
- Plot "Possible × Severe" on the sample matrix — what risk level is it, and what would you do?
- Give one limitation of risk matrices and how you would compensate for it.