## Using a Probability and Impact Matrix for Project Risk Management

written by: Sidharth Thakur • edited by: Ginny Edwards • updated: 8/15/2012

How do you assign priorities to risks? What’s the best way to present project risks? If you’re looking for answers to these questions, then you must read through this article.

• slide 1 of 2

Risk management is undeniably a critical aspect of project management. There are a number of tools available for managing risk, but one tool that’s very simple and gives a visual snapshot of the risks that a project faces - is the risk management probability and impact matrix. This matrix is used to classify risks on the basis of the impact they will have on the project and the probability of their occurrence. Before you read on about how to make a risk matrix for your project, you can download a free template of this matrix here and edit it to create a risk matrix for your project.

• slide 2 of 2

### Getting Started

Although there are several different versions of a risk assessment template or risk matrix, the template you’ve downloaded from the above link is of a 5x5 matrix which will help you develop a detailed and comprehensive probability and impact matrix. The scale you can use for classifying risks along these two risk measurement metrics is as follows:

Probability

On the basis of the chances of occurrence of the risks each risk can be classified under one of the following probabilities:

• Definitely – 80 to 100 percent chances of occurrence
• Likely – 60 to 80 percent chances of occurrence
• Occasional – 40 to 60 percent chances of occurrence
• Seldom – 20 to 40 percent chances of occurrence
• Unlikely – less than 20 percent chances of occurrence

Impact

On the basis of the impact that a risk will have on the project, the risk can be classified under one of the five degree of impacts:

• Catastrophic: A risk that can prove detrimental for the whole project.
• Critical: Risks which can significantly jeopardize some aspects of the project, but which will not completely ruin the project.
• Moderate: Risks which will cause some problems, but nothing too significant.
• Marginal: Any risks which will have just a mild impact on the project, still these must be addressed in time.
• Insignificant: Risks which do not pose any significant threat and which can be left unmediated without any fear.

Based on how each risk scores on these two scales it can be placed in one of the intersecting cells. Once all the risks have been allocated a place on this risk management probability and impact matrix, here’s how to interpret the entries on this matrix.

Each of the cells on this 5x5 matrix has been given one of the four colors – red, pink, orange and green. The significance of these colors is:

Red (Extreme Risk) – All risks that fall in the red cells are of utmost importance. Prevention and mitigation strategies for all these risks must be framed much in advance so as to prevent their occurrence or to fight them back as soon as they surface up.

Pink (High Risk) – These are the risks that again must be optimally addressed, however they do not enjoy top priority like the risks in red cells. These are also significant risks and it’s advisable to have them included in the risk management strategies.

Orange (Medium Risk) – These are risks which can be left out during the formulation of risk management strategies, as these are low priority risks and can be handled as and when they arise. However, that does not mean these risks can be ignored altogether.

Green (Low Risk) – The risks in the green are nearly harmless and in most cases these can be safely ignored. Most risks in this category don’t require any mediation at all.