Risk assessment matrix: how to score and prioritise project risks

A risk assessment matrix is a visual tool used to score project risks and determine which require the most attention. It plots each risk according to its likelihood and potential impact, producing a rating that indicates its relative priority. Project teams can then use those ratings to decide how each risk should be managed.

What is a risk assessment matrix?

A risk assessment matrix provides a consistent way to compare risks that might otherwise be difficult to judge against one another. Each identified risk is assessed against two axes: likelihood considers how probable it is that the event will occur, while impact measures the potential effect on the project if it does.

These assessments are converted into scores and plotted on the matrix. Higher-scoring risks usually demand greater attention, allowing project teams to concentrate effort where exposure is greatest.

The matrix forms part of the wider risk management process rather than replacing it. Risks still need to be identified and assigned to appropriate owners, while responses should be planned according to the level of exposure. The matrix provides a common basis for making those decisions.

How to score likelihood and impact

Most organisations use either a 3x3 or 5x5 matrix. A 3x3 version offers a simple low, medium and high scale, while a 5x5 matrix provides greater distinction between risks and is often more useful for complex projects.

Whatever scale is chosen, every level needs a clear definition. A likelihood score of 4, for example, means little unless everyone understands what makes an event ‘likely’. An organisation might define it as a probability between 60% and 80%. Impact should be equally specific, using measures that reflect the project and its objectives.

Consistency matters because two people might interpret terms such as ‘unlikely’ or ‘major’ very differently. Defining the criteria before risks are scored reduces subjective judgement and makes comparisons more meaningful.

Consider a project using a 5x5 matrix, where 1 represents the lowest likelihood or impact and 5 the highest:

The score is calculated by multiplying likelihood by impact. The supplier risk therefore receives the highest score even though the system outage would have a more serious impact if it occurred. This distinction is exactly what the matrix is designed to reveal.

Reading the matrix and prioritising risks

Risk scores are usually grouped into colour bands that correspond to different levels of exposure. Green commonly represents risks that can be accepted or monitored, while amber indicates that some form of active management may be required. Red is generally reserved for risks that exceed agreed thresholds and need prompt attention. (This labelling system is commonly referred to as “RAG rating” after the red, amber and green colours.)

The boundaries between these bands should reflect the organisation rather than being copied from a generic template. A score of 10 might be acceptable in one environment and require escalation in another.

Each band should also lead to a clear management response. Lower-level risks may remain under observation, while greater exposure could require mitigation or escalation. Responsibility will likely increase alongside the rating, with serious risks referred to the project board when they exceed the authority delegated to the project manager.

Within structured approaches such as PRINCE2® Project Management, this supports management by exception. Defined thresholds allow decisions to remain at the appropriate level while giving the project board visibility when exposure moves beyond agreed limits. PRINCE2® Foundation and Practitioner training explores how risk management fits within wider project governance.

Risk appetite and tolerance

Risk appetite describes how much risk an organisation is willing to accept in pursuit of its objectives. It is normally determined at organisational or senior leadership level and provides context for decisions made within individual projects.

Two organisations could assess exactly the same risk and reach the same numerical score but respond differently. An organisation with a low appetite for that type of exposure might place the score within its red band, whereas another may consider it manageable. Risk appetite therefore influences where thresholds are set on the matrix.

Risk tolerance is related but more specific. Appetite describes the general amount or type of risk an organisation is prepared to take, whereas tolerance defines the acceptable variation around a particular objective or limit.

For example, an organisation may accept some schedule uncertainty because launching a new service quickly offers a worthwhile opportunity. Its tolerance might then specify how much delay is acceptable before the risk requires escalation.

Understanding this distinction prevents the matrix becoming a purely numerical exercise. PRINCE2® Risk Management training develops a broader understanding of how organisations assess exposure and make informed risk decisions.

Building it into your risk management plan

A risk assessment matrix is most useful when it forms part of the risk management plan rather than being completed once and forgotten. The scoring criteria should be documented so everyone assessing risks uses the same basis for judgement.

Scores then feed into the risk register, where individual risks can be tracked alongside their planned responses. Regular reviews allow teams to see whether exposure has changed and whether existing action remains appropriate.

How often risks need to be rescored depends on the project. A regular review cycle provides a baseline, but teams should also reassess a risk when circumstances materially change. New information about a supplier, for example, could alter its likelihood before the next scheduled review.

Rescoring also matters after a response has been implemented. Comparing the revised exposure with the original score shows whether the action has reduced the risk sufficiently or whether further intervention is needed.

FAQs

What is a 5x5 risk matrix?

A 5x5 risk matrix assesses likelihood and impact using scales from 1 to 5, creating 25 possible positions. Multiplying the two ratings produces a risk score between 1 and 25. Organisations then use defined thresholds to determine the level of management attention each score requires.

How do you calculate a risk score?

A basic risk score is calculated by multiplying the likelihood rating by the impact rating. On a 5x5 matrix, a risk with likelihood 4 and impact 3 would therefore score 12. The numerical result should always be interpreted against the organisation's agreed thresholds rather than viewed in isolation.

What is the difference between risk appetite and risk tolerance?

Risk appetite describes the overall level or type of risk an organisation is willing to accept in pursuit of its objectives. Risk tolerance sets more specific boundaries around acceptable variation. Both influence how an organisation interprets scores and determines when a risk needs further action.

Who is responsible for the risk matrix on a project?

Responsibility depends on the organisation's governance arrangements. The project manager will often maintain the project's risk information, while individual risk owners manage specific threats or opportunities. Senior decision-makers establish the wider appetite and escalation thresholds within which the project operates.

A well-designed matrix turns risk scoring into a practical basis for decision-making, giving teams a consistent way to determine where management attention is needed. Explore ILX project management training to develop the skills needed to manage project risk with greater confidence.

Explore PRINCE2® Risk Management training.