Risk Assessment Matrix – How to Use It in Risk Management

A risk assessment matrix is a project management tool that allows a single page – quick view of the probable risks evaluated in terms of the likelihood or probability of the risk and the severity of the consequences.

A risk assessment matrix is easier to make, since most of the information needed can be easily extracted from the risk assessment forms. It is made in the form of a simple table where the risks are grouped based on their likelihood and the extent of damages or the kind of consequences that the risks can result in. A sample risk assessment matrix can be downloaded for free from here.

Making a risk management matrix is the second step in the process of risk management, and it follows the first step of filling up a risk assessment form to determine the potential risks. The preparation of risk assessment forms is a more elaborate task and involves determining risks, gathering risk data, determining the probability and the impact levels of the risks, understanding consequences, assigning priorities and developing risk prevention strategies. On the other hand, a risk assessment matrix just provides the project team with a quick view of the risks and the priority with which each of these risks needs to be handled.

Sample Risk Assessment Matrix.bmp

Also in project planning, a different type of risk assessment template can be created in Excel and used to assess the overall risk of initiating a project.

Screenshot Taken By: Sidharth Thakur

How to Place Risks in the Matrix

As mentioned above, in a risk assessment matrix risks are placed on the matrix based on two criteria:

  1. Likelihood: the probability of a risk
  2. Consequences: the severity of the impact or the extent of damage caused by the risk.

Likelihood of Occurrence

Based on the likelihood of the occurrence of a risk the risks can be classified under one of the five categories:

  1. Definite: A risk that is almost certain to show-up during project execution. If you’re looking at percentages a risk that is more than 80% likely to cause problems will fall under this category.
  2. Likely: Risks that have 60-80% chances of occurrence can be grouped as likely.
  3. Occasional: Risks which have a near 50/50 probability of occurrence.
  4. Seldom: Risks that have a low probability of occurrence but still can not be ruled out completely.
  5. Unlikely: Rare and exceptional risks which have a less than 10% chance of occurrence.


The consequences of a risk can again be ranked and classified into one of the five categories, based on how severe the damage can be.

  1. Insignificant: Risks that will cause a near negligible amount of damage to the overall progress of the project.
  2. Marginal: If a risk will result in some damage, but the extent of damage is not too significant and is not likely to make much of a difference to the overall progress of the project.
  3. Moderate: Risks which do not impose a great threat, but yet a sizable damage can be classified as moderate.
  4. Critical: Risks with significantly large consequences which can lead to a great amount of loss are classified as critical.
  5. Catastrophic: These are the risks which can make the project completely unproductive and unfruitful, and must be a top priority during risk management.

Using the Risk Assessment Matrix

Once the risks have been placed in the matrix, in cells corresponding to the appropriate likelihood and consequences, it becomes visibly clear as to which risks must be handled at what priority. Each of the risks placed in the table will fall under one of the categories, for which different colors have been used in the sample risk assessment template provided with this article. Here are some details on each of the categories:

Extreme: The risks that fall in the cells marked with ‘E’ (red color), are the risks that are most critical and that must be addressed on a high priority basis. The project team should gear up for immediate action, so as to eliminate the risk completely.

High Risk: Denoted with ‘H’ with a pink background in the risk assessment template, also call for immediate action or risk management strategies. Here in addition to thinking about eliminating the risk, substitution strategies may also work well. If these issues cannot be resolved immediately, strict timelines must be established to ensure that these issues get resolved before the create hurdles in the progress.

Medium: If a risk falls in one of the orange cells marked as ‘M’ , it is best to take some reasonable steps and develop risk management strategies in time, even though there is no hurry to have such risks sorted out early. Such risks do not require extensive resources; rather they can be handled with smart thinking and logical planning.

Low Risk: The risks that fall in the green cells marked with ‘L’, can be ignored as they usually do not pose any significant problem. However still, if some reasonable steps can help in fighting these risks, such steps should be taken to improve overall performance of the project.

This post is part of the series: Risk Management – Tools and Techniques

Here’s a series of articles that discuss some of the best tools and techniques used for risk management in the field of project management.

  1. Basic Format for a Risk Register
  2. Samples of Risk Registers
  3. Using a Probability and Impact Matrix for Project Risk Management
  4. A Critical Tool for Assessing Project Risk
  5. Making the Risk Assessment Process More Fluid: Use This Sample Form