Build a 5×5 likelihood-and-consequence matrix, record the treatment and where each risk lands after it, and export the whole thing as an image for your report or a CSV for your register.
| ID | Risk | Owner | Inherent | Residual | Treatment |
|---|
A risk matrix rates every risk on two five-point scales — likelihood (how probable) and consequence (how bad) — and reads a severity band off the intersection. The point is not precision. It is that a hundred risks written by twenty different people end up on one comparable scale, so a register can be ranked, escalated and reported without re-arguing every entry.
| Score | Likelihood | Consequence |
|---|---|---|
| 5 | Almost certain — expected in most circumstances | Severe — project viability or safety at stake |
| 4 | Likely — will probably occur | Major — significant cost, delay or reputational damage |
| 3 | Possible — might occur at some time | Moderate — manageable with re-planning |
| 2 | Unlikely — could occur at some time | Minor — absorbed within contingency |
| 1 | Rare — only in exceptional circumstances | Insignificant — no material effect |
Plenty of matrix templates score risk as likelihood × consequence. That quietly produces the wrong answer at the edges. A rare but catastrophic event scores 1 × 5 = 5. A likely but trivial one scores 4 × 2 = 8. Multiplication says the trivial one is worse — and no board on earth would agree.
This tool uses a lookup grid instead, the shape used in AS/NZS ISO 31000-style registers: the severe-consequence column stays serious no matter how unlikely it is, because the organisation's tolerance for catastrophic outcomes does not scale linearly with probability. The grid above the register shows exactly which cell maps to which band.
Inherent risk is where the risk sits if nobody does anything. Residual risk is where it sits once the agreed treatment is in place. Most matrices only plot the first, which makes them a picture of the problem rather than a picture of the plan.
Plotting both is uncomfortable in a useful way. Switch the toggle to Residual and any treatment that fails to move its risk down a band becomes visible immediately — and a treatment that does not change the rating is a note, not a control. That single test removes more theatre from a risk register than any amount of re-wording.
It compresses a whole distribution into one cell. It cannot tell you that the "major" cost consequence is $80k on one risk and $2.4m on another, and it cannot add risks together — five moderate risks on the same activity may be worse than one high risk elsewhere, and the matrix will never say so.
It is also less objective than it looks: two experienced people rating the same risk routinely land a band apart. That is fine for prioritising and escalating, which is what it is for. When you need exposure in real numbers — how many days of delay, how much contingency — you need a quantitative method that runs the risks against the schedule, not a grid.
A grid rating each risk on a five-point likelihood scale and a five-point consequence scale, with a severity band read off the intersection so a whole register can be ranked consistently.
Look it up in the grid rather than multiplying. Multiplying makes a rare catastrophe (1×5) score lower than a likely nuisance (4×2), which is the opposite of how organisations actually want to act.
Inherent is the rating before treatment; residual is the rating you expect after the agreed controls are working. Plotting both shows which treatments actually change anything.
Only in this browser's local storage on this device, so a reload does not lose it. Nothing is sent to a server. Clearing browser data clears it — export the CSV to keep it.
It compresses a distribution into one cell, cannot add risks together, and two people will often rate the same risk a band apart. Use it to prioritise and communicate, not to quantify exposure.
Aegis holds risks against the schedule they threaten — so an extreme risk on a critical activity shows up in the status report, in the contingency position, and in what the client is told this month.
Start your 14-day trial →