Visualizing Risk for Decision-Making
A risk matrix (also called a risk heat map) is a visual tool that plots risks on a grid with likelihood on one axis and impact on the other. It is the most common way to communicate risk posture to non-technical stakeholders because it makes priorities immediately obvious through color coding.
Building a practical risk matrix:
Use a 5-point scale for each axis:
Likelihood Scale:
| Rating | Label | Meaning |
|---|---|---|
| 1 | Rare | Less than once per 5 years |
| 2 | Unlikely | Once per 1–5 years |
| 3 | Possible | Once per year |
| 4 | Likely | Monthly |
| 5 | Almost Certain | Weekly or more |
Impact Scale:
| Rating | Label | Meaning |
|---|---|---|
| 1 | Negligible | No user impact, internal only |
| 2 | Minor | Single user or small group affected briefly |
| 3 | Moderate | Service degraded for many users, under 1 hour |
| 4 | Major | Full service outage, over 1 hour, SLA breach |
| 5 | Catastrophic | Data loss, regulatory violation, existential threat |
Risk zones:
- Green (score 1–6): Accept the risk. Monitor but do not invest heavily.
- Yellow (score 7–12): Mitigate when convenient. Track in risk register.
- Orange (score 13–19): Actively mitigate. Assign an owner and a deadline.
- Red (score 20–25): Stop and fix now. This is a blocking priority.
The matrix is a communication tool, not a decision-making algorithm. Its purpose is to create shared understanding across engineering, product, and leadership about where the biggest exposures are.
Key Point: Risk matrices have a well-known limitation: they can make very different risks look equivalent. A "Likely × Minor" risk (score 8) and an "Unlikely × Major" risk (score 8) have the same score but demand completely different responses. Always supplement the matrix with narrative context. The matrix starts the conversation — it should not end it.