Node A4

5×5 Risk Matrix Builder

Keep the register, plot the cube. Each risk is a labeled dot at its likelihood × consequence cell, banded with the standard green/yellow/red scheme, ready to drop into a review package.

How to read — and not abuse — a risk cube

A 5×5 risk matrix is a communication device, not an analysis. It compresses two judgments — how likely is this, how bad would it be — into one cell so a room full of people can agree on which risks deserve attention this month. The banding follows the standard convention: high risks concentrate toward the top-right, where likely meets severe, and anything red should have a named owner and a funded mitigation before the meeting ends.

The 3×3 disease. The most common failure mode is every risk landing at moderate likelihood, moderate consequence — dead center. It feels safe: nobody has to defend an extreme. But a matrix where everything is yellow carries zero information. Force the discrimination: for likelihood, tie each level to a probability range (5 = near certain, >80%; 1 = remote, <10%) and for consequence, tie each level to a concrete program impact (5 = can't meet a KPP; 3 = eats schedule margin; 1 = absorbed in normal work). If two risks genuinely differ, their cells should too.

Mitigation is not acceptance. Every risk on the chart needs one of four dispositions: mitigate (spend resources to move it down or left — and re-plot it at its post-mitigation position, keeping the original as a ghost if you want to show progress), accept (document who accepted it and why the residual is tolerable), transfer (make it contractually someone else's), or watch (define the trigger that promotes it to active mitigation). A register full of risks with mitigation text but no owner, no date, and no re-scored residual is a list of worries, not a risk process.

Likelihood × consequence is not multiplication. Resist reducing the matrix to a single "risk score" of L×C. A 5×1 annoyance and a 1×5 catastrophe both score 5, but they demand completely different responses. The two axes carry different information; that's why it's a matrix and not a number.

Everything runs locally in your browser. Your register never leaves the page.