Interactive Risk Matrix
Score every business risk on likelihood and impact, see the heat map, and know which three to fund first.
Example scenario—not a forecast or verified benchmark. Enable JavaScript to edit inputs, view charts, save locally and export your analysis.
Example inputs
- Your risk register
- [{"name":"Loss of largest customer","likelihood":3,"impact":5,"owner":"CEO","mitigation":"planned"},{"name":"Ransomware / data breach","likelihood":3,"impact":4,"owner":"IT lead","mitigation":"in_progress"},{"name":"Key employee departure","likelihood":4,"impact":3,"owner":"","mitigation":"none"},{"name":"Cash shortfall from slow collections","likelihood":3,"impact":4,"owner":"Controller","mitigation":"none"},{"name":"Supplier disruption or price shock","likelihood":3,"impact":3,"owner":"Ops manager","mitigation":"in_place"},{"name":"Regulatory or licensing change","likelihood":2,"impact":3,"owner":"CEO","mitigation":"planned"}]
- Risk appetite (highest residual score you accept without a funded plan)
- 9
Example results
1 critical and 2 high risks; 3 of 6 sit above your appetite of 9, led by "Loss of largest customer" at 15/25.
- Risks above appetite
- 3
- Critical risks (15+)
- 1
- High risks (10-14)
- 2
- Exposure index
- 39/100
- Average residual score
- 9.8
- Risks with no owner
- 1
- Risks scored
- 6
What stands out
1 critical risk (score 15+)
Loss of largest customer (15). These need a funded plan and a monthly check-in, not a line in a spreadsheet.
3 high-inherent risks have no active mitigation
Loss of largest customer, Cash shortfall from slow collections, Key employee departure score 10+ before controls, and work has not started.
1 risk has no owner
Key employee departure. Unowned risks are the ones that get discovered after they happen.
Next actions
- Fund a mitigation for "Loss of largest customer" (residual 15/25): CEO owns it; set a 30-day action with a measurable early-warning trigger.
- Fund a mitigation for "Cash shortfall from slow collections" (residual 12/25): Controller owns it; set a 30-day action with a measurable early-warning trigger.
- Name an owner this week for: Key employee departure.
- Re-score the register quarterly and after any near miss; track residual scores over time, not just the list.
Model assumptions & limitations
- Scores are self-assessed on 1-5 scales; residual score = likelihood x impact after mitigation (1-25).
- Rule of thumb: a mitigation in progress removes about 25% of inherent score, one in place and tested about 50%. Planned work removes nothing until it starts.
- Tiers: Critical 15+, High 10-14, Medium 5-9, Low under 5. Adjust appetite to match your tolerance.