Risk Matrix & Risk Register
Log project risks, score probability × impact on a 5×5 scale and see them on a live heatmap. Assign owners and responses, then export your register.
| ID | Risk | Category | Probability | Impact | Score | Owner | Response | Action |
|---|
Heatmap
P = probability (rows), I = impact (columns). Risk IDs are placed in their cell.
How to write a good risk statement
Use cause → risk → effect: "Because the vendor's API is still in beta (cause), it may change without notice (risk), which would break checkout and delay launch by 2–4 weeks (effect)." Vague risks such as "resources" or "budget" cannot be scored or owned.
Probability and impact scales
| Score | Probability | Impact (example) |
|---|---|---|
| 1 | Rare (<10%) | Negligible; absorbed by the team |
| 2 | Unlikely (10–30%) | Minor slip, <2% budget |
| 3 | Possible (30–50%) | Milestone moves, 2–5% budget |
| 4 | Likely (50–80%) | Key deliverable late, 5–10% budget |
| 5 | Almost certain (>80%) | Objectives fail, >10% budget |
Calibrate impact to your project — a 2% overrun on a $10M programme is not the same as on a $20k website. More in the project risk management guide.
Frequently asked questions
How is the risk score calculated?
Score = probability (1–5) × impact (1–5), giving 1 to 25. 15–25 is Critical, 10–14 High, 5–9 Medium and 1–4 Low.
What are the risk response strategies?
For threats: avoid, mitigate, transfer, accept or escalate. For opportunities: exploit, enhance, share, accept or escalate.
How often should I review the risk register?
At least every two weeks, and at every phase gate. Review high and critical risks weekly.