Risk Matrix in Project Management: What is it and How to Use it
The risk matrix is a concept we’ve been getting close to anytime project management is mentioned. Risks are a part of any project, and it’s clear that, unfortunately, there’s no way of knowing for sure when and where they’ll occur.
While it’s not impossible to go through a project without suffering from any risks or consequences, that’s very much improbable. In everything we do in life, the Law of Murphy (everything that can go wrong, will) is right around the corner, ready to attack.
What we can do regarding risk probability is preventing project risks and be prepared for them, and a risk matrix can be quite helpful.
What is a risk matrix in project management?
The risk matrix is a widely used project management technique to do risk analysis. It’s a tool that will provide information about the probability of a risk happening and if it’ll be a major or a minor problem.
Once the risk assessment is made, in terms of calculating the likelihood and severity of each risk, it’s possible to organize them along a matrix to calculate risk impact ratings.
This exercise is critical since it helps prioritize the risks in a project and then manage them.
The risk matrix is part of the program of the APM – one of the best pmp certifications.
Risk matrix example
The risk matrix is a standard tool in a project risk management plan and allows the project manager and team members to analyze every risk by determining each event as high, medium, or low impact.
The risk matrix can be calculated using different templates, such as a 5×5, but also 3×3 or 4×4. Once the severity and likelihood of each risk are assessed, it’s possible to prioritize risks and prepare for them as needed.
To show an example of a risk matrix here, we’ll use a 4×4 risk assessment matrix.
The first thing to do is to identify as many potential risks as possible. A brainstorming session with the project team is ideal for analyzing and identifying potential risks related to the project itself.
It’s also helpful to organize these risks by type in separate documentation. The assessment form or risk registry should look something like this.
Risk matrix template
| Potential Risks | Likelihood/Probability | Impact/Severity | Risk Rating |
| risk a | – | – | – |
| risk b | – | – | – |
| risk c | – | – | – |
| risk d | – | – | – |
Likelihood / Probability
Follow up by determining the risk likelihood and the scale you’ll be using. Usually, the likelihood levels follow the levels of the matrix.
So, using a 4×4 matrix means we’ll have four risk levels. The complete risk matrix is the 5×5. Let us consider these four:
- Very Unlikely / Unlikely
- Possible
- Probable
- Very Likely
| Potential Risks | Likelihood/Probability | Impact/Severity | Risk Rating |
| risk a | 4 | – | – |
| risk b | 3 | – | – |
| risk c | 1 | – | – |
| risk d | 3 | – | – |
Impact / Severity
Next up, the impact or severity scale needs to be ranked. In this case, we’ll also consider four levels.
- Very Low / Low
- Moderate
- Significant
- Catastrophic
Note that these scales are completely customizable according to your needs and project specifications.
| Potential Risks | Likelihood/Probability | Impact/Severity | Risk Rating |
| risk a | 4 | 4 | – |
| risk b | 3 | 4 | – |
| risk c | 1 | 3 | – |
| risk d | 3 | 2 | – |
Calculate the risk rating
Next, it’s time to calculate the risk rating by using the formula likelihood/probability x impact/severity. Since we’re working with a 4×4 matrix, the higher value we will get is 16. This would be the highest-ranking risk.
These are the ones that can cause the project to go off the rails, so these need to be closely dealt with. Use this information to be preventive regarding this risk.
| Potential Risks | Likelihood/Probability | Impact/Severity | Risk Rating |
| risk a | 4 | 4 | 16 |
| risk b | 3 | 4 | 12 |
| risk c | 1 | 3 | 3 |
| risk d | 3 | 2 | 6 |
Final Risk Matrix
So, risk a is the most dangerous one. The other ones can also be organized at different levels. For example, in this particular case, 1-6 could be low, 7-11 medium, and 12-16 high.
Now all the information is available and ready to be inserted into the matrix. The risks will be identified and shortly described between the two axes. Obviously, some risks may fall on the same metric.
| Impact / Severity | |||||
|---|---|---|---|---|---|
| Probability / Likelihood | 1 | 2 | 3 | 4 | |
| 4 | risk a (16) | ||||
| 3 | risk d (6) | risk b (12) | |||
| 2 | |||||
| 1 | risk c (3) | ||||
To customize even further, the matrix can be color-coded, for example, green for low risk and red for high risk.
The benefits of a risk assessment matrix
Developing a risk assessment and then the matrix calculations is a critical step that is part of the project manager’s job and functions.
It’s fundamental to realize your assets and know how to handle and protect them. This is the main benefit of a risk assessment matrix.
Regularly performing a risk assessment is the key to figuring out what potential threats might harm the project’s life cycle, which is benefit number two.
Understanding the likelihood and hypothetical severity of the identified threats. Here enters the chance to calculate the risk matrix. Doing this allows the opportunity to be proactive regarding risks instead of reactive.
The risk assessment matrix is the tool that allows the implementation of proactive measures to minimize the impact of the project’s risks.
Free eBook: The Project Manager’s Handbook on Time Tracking
Get your step-by-step guide to master time tracking as a Project Manager
TIP: Enroll in one of the best project management courses and learn how to use a risk matrix in PM.
The challenges of a risk matrix
Using a risk matrix can present some challenges or difficulties, so an experienced project manager is always a plus. These challenges can present themselves as a lack of accuracy, for example.
The categories may not be specific enough, and if they fail, the wrong decisions can be made, or the wrong paths can be taken. The use of a risk matrix always presents a risk itself.
Sometimes, the categorization of likelihood and severity is too subjective and oversimplified, making the risk matrix not completely reliable.
It’s important to note that a risk matrix mirrors the time period when it was built and doesn’t consider how risks change over the years.
FAQ
How do you calculate risk in a risk matrix?
The risk is calculated by crossing the probability or likelihood of a risk happening with the impact or severity it can have on the project if it does happen.
What do you do with risk matrix results?
The risk matrix results you’ll get will be fundamental in creating a response or action plan to respond and mitigate the risks. With the data you gather, it’ll be possible to build reports and assign mitigation tasks to the team members with the better skills to work on them.
It’s crucial to start by addressing the risks that are ranked higher and keep monitoring the rest.
Using this tool is a powerful way to support the work team and mitigate any issues that may hinder a successful project.
Find out what are the best prioritization techniques to manage your project.
Who invented the risk matrix?
There are some divergent opinions about the origins of the use of the risk matrix, but the most consensual is that it was first proposed in the US Air Force.
What is a risk matrix score?
A risk matrix score is a metric used to predict the aspects of the risk. The score is reached or developed by using the indicators in the analysis.
How to make a risk matrix in Excel?
It’s possible to build a risk matrix on Microsoft Excel by creating a table that considers the probability ad severity scales. Add labels, and use the columns for severity and rows for the probability of occurrence. Ensure that every phrase and definition used are the ones the team outlined.
Color coordinate the risk matrix for a better and easier-to-interpret visual representation. Assign the values determined and apply the multiplication formula to calculate the risk.
Why is a risk matrix necessary?
A risk matrix provides a solid knowledge of the risk environment and what can really go wrong during the project’s life cycle. Risks and their complexity won’t stop growing and evolving. In plain terms, you never know what tomorrow brings.
Now, and more than ever, companies must meet the present and future challenges, identifying, analyzing, and mitigating risks efficiently.
What are the 5 elements of risk management?
The 5 elements of risk management are identification, analysis, planning, mitigation, and monitoring.
The risk matrix is also known as?
The Probability and Severity risk matrix.
What is a 3×3 risk matrix?
A risk assessment matrix contains a set of values that determine a risk’s probability and severity. A 3×3 risk matrix has 3 levels of probability and 3 levels of severity.
What is a 4×4 risk matrix?
A risk assessment matrix contains a set of values that determine a risk’s probability and severity. A 4×4 risk matrix has 4 levels of probability and 4 levels of severity.
What is a 5×5 risk matrix?
A risk assessment matrix contains a set of values that determine a risk’s probability and severity. A 5×5 risk matrix has 5 levels of probability and 5 levels of severity.
Conclusion
This kind of tool has as much of an analog as it is digital, and the major benefit is that it can be used to manage multiple projects. However, every project faces unique risks, and these issues need frequent reevaluation.
Unfortunately, using a risk matrix doesn’t solve every issue, but it will help reduce both the probability and impact of a problem. Use it in your strategy.
You might be interested in: