A Risk Assessment Matrix is a tool used in project management and many other fields as part of the process of identifying, assessing, and prioritizing risks. The risk matrix provides a visual reference showing the rating scales used for the Likelihood and Impact of a risk, which are either added or multiplied to calculate a Risk Score. The risk score is often color-coded to help in prioritizing the risks.

Our free Risk Assessment Template below provides a way to create and customize the risk matrix. But perhaps more importantly, it includes an example of a basic Risk Assessment table showing how to implement the rating scales within drop-down lists, with conditional formatting to highlight the Risk Score.

In addition to the green-yellow-red matrix, the risk assessment template includes worksheets for customizing a white-red and blue-red design, shown below:

Likelihood (Probability) Rating

The Likelihood, or probability, of a risk refers to the chance of the risk event occurring. The definitions for the rating scale may be qualitative, quantitative, or a combination of both and should be customized based on the types of risk events being analyzed. For example, natural disaster events may occur at rates of months to millennia, while risk events at a theme park might occur at rates of hours to days or years.

It may be important to provide a description of the rating scale you are using so that everyone on your team will understand the scale. How rare is rare? What does "occasional" mean? If the probability can be quantified in some way, even roughly, doing so may be helpful as the team works together to rate each risk.

Below is an example of a 5-point rating scale for the Likelihood axis, along with some examples of different types of qualitative and quantitative definitions.

Example: 5-Point Rating Scale for the Likelihood Axis

Rating	Label	Description	Probability	Frequency	Rate	Example
1	Rare	Very rare or highly unlikely	<0.01%	≤1 in 10,000	Once per Century	Possible, but hasn't been observed anywhere yet
2	Unlikely	Could occur at some time	0.1% - 1%	1 in 2,000	Once per Decade	Has not occurred here, but has been observed elsewhere
3	Occasional	Might occur occasionally	1% - 20%	1 in 200	Once per Year	Has occurred at least once
4	Likely	Likely to occur often	20% - 95%	1 in 20	Once per Month	Has occurred occasionally (annually)
5	Almost Certain	Expected under most conditions	>95%	≥1 in 10	Once per Week	Has occurred frequently (multiple times per year or even weekly/daily)

You would choose and customize the definitions for the scale based on your particular application. For example, the table below is a detailed definition for the likelihood within a DFMEA (Design Failure Modes and Effects Analysis) for a specific product.

Example: Detailed 5-Point Likelihood Scale for DFMEA

Likelihood Rating	Description	Probability of Occurrence	Example
1 - Very Unlikely	Failure is highly improbable. The design is proven to be highly reliable, and the cause of failure is rarely encountered.	Less than 1 in 10,000 occurrences	The component has been used successfully in numerous designs without failure.
2 - Unlikely	Failure is unlikely to occur. There is low exposure to risk due to strong controls or proven design practices.	Between 1 in 2,000 and 1 in 10,000 occurrences	The component has a low history of failure, with robust design safeguards in place.
3 - Possible	Failure may occur under specific conditions. Moderate exposure to risk, and while controls are in place, they may not fully prevent the failure.	Between 1 in 200 and 1 in 2,000 occurrences	Design is generally reliable, but similar components have shown occasional failure under certain conditions.
4 - Likely	Failure is likely to occur. The design shows weaknesses or lacks sufficient controls, and past data indicates similar failures in other designs.	Between 1 in 20 and 1 in 200 occurrences	Known vulnerabilities in the design may lead to failure under certain stresses or loads.
5 - Very Likely	Failure is almost certain to occur. The design or process is new or untested, with high exposure to risk and little-to-no preventive controls.	Greater than 1 in 20 occurrences	Similar designs have failed frequently, or the failure mode is inherent to the current design approach.

Important: A risk assessment is often based on rough qualitative information, expert opinion and experience, without much hard data. So, although it may be useful for a team to review a detailed example like the one above, it may be more efficient to reduce your definition down to just a few words or a definition like "~1 in X." Otherwise, your team may get bogged down by the definitions.

Impact (Severity) Rating

The horizontal axis of the risk assessment matrix measures the Consequence, Impact or Severity of the risk if it does occur. These three terms are used synonymously, so choose the term that best applies to your case.

Remember when rating the impact or severity to rate just a single occurrence of the failure or event, not the overall impact of all events. For example, you can ask "If this failure does occur, how severe is the consequence of a single occurrence? Is the consequence Insignificant, Minor, Moderate, Major, or Catastrophic?"

The 5-point rating is common, but you may want to adjust the definitions for your particular application based on the type of failure or type of operational damage, financial setback, and/or personal injury. The rating scale below provides a few examples.

Example: 5-Point Rating Scale for the Impact Axis

Impact Rating	Impact	Operational Effect	Financial Effect	Injury	Pain Level
1 - Insignificant	Minimal or no impact	Negligible delay (<1 day)	Minimal financial effect	Annoyance-level injury at most	0 Pain
2 - Minor	Low impact	Minor operational delay (a few days)	Acceptable financial setback	Injury may require non-professional first aid	1-2 Pain
3 - Moderate	Noticeable impact	Significant project delay (a few weeks)	Moderate financial loss	Injury may require professional treatment	3-6 Pain
4 - Major	Significant impact	Widespread project disruption (a year or more)	Large financial loss	Hospitalization	7-9 Pain
5 - Catastrophic	Critical impact	Project failure or cancellation	Severe financial damage	Death or permanent disability	10 Pain

For a financial effect, it may be possible to come up with dollar amounts to help define the scale. Other effects to consider may be reputation, health, legal, worker morale, security or customer satisfaction.

Different failures may cause different types of effects, so your risk assessment impact rating may need to consider the combination of multiple effects. Use a table like the one above as a reference if you want to define a scale for different types of effects.

When you create your table of risks, you can add notes and descriptions for each failure mode to explain the reason for the rating.

Risk Score

The Risk Score shown within the body of the matrix is calculated by either adding or multiplying the Likelihood and Impact ratings.

Addition Method: Risk Score = Likelihood + Impact

Using this calculation provides a simple, linear, and balanced view of risk but may lack sensitivity to extreme values compared to the multiplication method. The linear score ranges from 2 to 10, with 6 being the exact middle. A notable difference has to do with the 1:5 and 5:1 rating combinations, which are given more weight than in the multiplication method.

Multiplication Method: Risk Score = Likelihood x Impact

This is the most common method in industry, particularly for FMEA. The scores range from 1 to 25, exponentially, and this tends to emphasize the extreme values (the risks with higher likelihood and impact). You can customize the color scale in the Risk Assessment Matrix template to produce a more balanced color scale, such as setting the midpoint color to 8 like in the example above. This is discussed in the next section.

Creating a Color Scale with Conditional Formatting

Excel makes it very simple to add a color scale to your Risk Score. Just go to Home > Conditional Formatting > Color Scales and pick the Red-Yellow-Green option. After creating this conditional format, you can edit the properties of the color scale by going to Home > Conditional Formatting > Manage Rules.

Color-Scale Warning!

The default 3-Color Scale in Excel uses a Midpoint color that is based on the 50th Percentile of the values. It uses the "Lowest" value for Green and the "Highest" value for Red. This works for creating the Risk Assessment Matrix, but not for color-coding the tasks in your FMEA or risk assessment table.

What You Need to Do: If you want the color scale in your risk assessment matrix to be the same as the color-scale in your risk assessment table or FMEA, you need to set the color scale values to specific Minimum/Midpoint/Maximum numbers, such as in the example below.

Note that in the above example, I entered 6 as the value for the Midpoint. A value of 6 tends to work well for both the Addition and Multiplication methods.

You can make the red and the green darker if you want to emphasize the extremes even more. For accessibility, specifically color blindness, you can use a blue-white-red or white-red scale. See the image below for a comparison of some color scales.

Risk Management Resources

The Risk Assessment Matrix is just one of the many tools used in risk management. Different industries may have different standards for how to define the scales and ratings. To learn more about this topic, consider some of these sites:

• What is Risk Management & Why It Is Important? - Kate Gibson, Harvard Business School Online.
• Risk Management - FEMA.gov (related to natural disasters).
• Risk Management at wikipedia.com - A good starting point with many references and resources.

 

FB  PIN  TWEET  LI  IG  YT