Risk Matrix: Complete ISO 31010 Risk Assessment Guide
A risk matrix is a risk assessment technique used to prioritize risks by combining likelihood and consequence. This guide explains how to design, apply and improve risk matrices according to ISO 31010 good practices.
Published: 8/1/2026Updated: 8/1/2026By growGRC Editorial Team
Executive Summary
A risk matrix is a risk assessment technique used to classify and prioritize risks by combining likelihood and impact. ISO 31010 recognizes this approach as a practical method to support risk evaluation and treatment decisions.
Key Takeaways
✓A risk matrix combines likelihood and impact.
✓It is recognized as a risk assessment technique within ISO 31010.
✓Complex risks may require additional analytical techniques.
Risk Matrix: Complete ISO 31010 Risk Assessment Guide
Executive Summary
A risk matrix is one of the most widely used techniques for evaluating and prioritizing risks in modern Governance, Risk and Compliance (GRC) programs.
Its purpose is to transform qualitative or semi-quantitative information about risks into a visual classification that supports decision-making.
The technique usually combines two main dimensions:
Likelihood of occurrence.
Consequence or impact.
The result helps organizations determine risk levels and decide whether risks should be accepted, treated, transferred or mitigated.
ISO 31010 recognizes risk matrices as a valid technique to support risk assessment, especially when organizations need a simple, consistent and easy-to-communicate approach.
A risk matrix is a visual tool that represents the relationship between the likelihood of an event occurring and the magnitude of its consequences.
It helps organizations answer questions such as:
Which risks require immediate attention?
Which risks can be accepted?
Where should resources be allocated?
Which controls require improvement?
Fundamental Concept
Risk assessment using a matrix generally follows this logic:
Components of a Risk Matrix
A traditional risk matrix contains two main dimensions.
Likelihood
Represents the probability that an event will occur.
Example:
Level
Description
1
Rare
2
Unlikely
3
Possible
4
Likely
5
Almost Certain
Impact
Represents the magnitude of consequences.
Example:
Level
Description
1
Insignificant
2
Minor
3
Moderate
4
Major
5
Critical
Example of a 5x5 Risk Matrix
Likelihood / Impact
1 Low
2 Minor
3 Moderate
4 Major
5 Critical
5 Almost Certain
Medium
High
High
Critical
Critical
4 Likely
Medium
Medium
High
High
Critical
3 Possible
Low
Medium
Medium
High
High
2 Unlikely
Low
Low
Medium
Medium
High
1 Rare
Low
Low
Low
Medium
Medium
How to Build a Risk Matrix
Step 1: Define Objectives
Before assessing risks, organizations should understand which objectives may be affected.
Example:
Objective:
Maintain SaaS service availability.
Step 2: Identify Risk Events
Example:
Event:
Service interruption.
Cause:
Cloud provider failure.
Consequence:
Customer service disruption.
Step 3: Define Assessment Criteria
Organizations should establish clear criteria.
Example:
Likelihood:
Rare.
Unlikely.
Possible.
Likely.
Almost Certain.
Impact:
Financial.
Operational.
Regulatory.
Reputational.
Strategic.
Step 4: Evaluate Risk
The combination creates a risk classification.
Example:
Likelihood:
4 - Likely.
Impact:
5 - Critical.
Result:
Critical Risk.
Inherent Risk and Residual Risk
A mature risk management process distinguishes between:
Inherent Risk
The level of risk before considering controls.
Residual Risk
The level of risk after considering existing controls.
Risk Matrix Applications in GRC
Risk matrices are commonly used in:
Area
Application
Enterprise Risk
Strategic prioritization
Cybersecurity
Threat evaluation
Audit
Risk-based planning
Compliance
Regulatory prioritization
Projects
Uncertainty management
Practical Example
Financial Services Company
Risk:
Electronic fraud.
Cause:
Weak authentication mechanisms.
Event:
Unauthorized access.
Impact:
Financial losses and regulatory penalties.
Assessment:
Likelihood:
4 - Likely.
Impact:
5 - Critical.
Risk Level:
Critical.
Treatment:
Implement multi-factor authentication and continuous monitoring.
Best Practices
Recommended
Avoid
Define clear criteria
Subjective scoring
Review regularly
Outdated assessments
Include multiple dimensions
Financial-only evaluation
Link risks to objectives
Isolated risk lists
Common Mistakes
Using the same matrix everywhere
Different organizational areas may require different criteria.
Confusing frequency with likelihood
A frequent event is not always the highest risk.
Failing to update assessments
Risks change as business environments evolve.
Advantages of Risk Matrices
Easy communication.
Visual prioritization.
Executive-friendly reporting.
Supports resource allocation.
Enables comparison between risks.
Limitations
Risk matrices also have limitations:
They may oversimplify complex scenarios.
They can introduce human bias.
They depend on well-defined criteria.
For complex risks, organizations may require complementary techniques such as:
Monte Carlo Analysis.
Bayesian Networks.
Fault Tree Analysis.
Event Tree Analysis.
Relationship with ISO 31010
ISO 31010 positions risk matrices as a practical technique within the broader collection of risk assessment methods.
Selection should consider:
organizational context;
objectives;
information availability;
risk complexity;
required accuracy level.
Implementation Checklist
[ ] Define likelihood scales.
[ ] Define impact scales.
[ ] Approve assessment criteria.
[ ] Train users.
[ ] Document methodology.
[ ] Review periodically.
[ ] Integrate with risk registers.
Conclusion
Risk matrices remain one of the most commonly used risk assessment techniques because of their simplicity and communication value.
When properly designed, they help organizations connect risks with objectives and improve risk-informed decision-making.
SUPPORTS
ISO 31000 Risk Assessment: Complete Guide to Risk Identification, Analysis and Evaluation
ISO 31000 risk assessment enables organizations to identify, analyze and evaluate risks to understand exposure levels and make informed treatment decisions.
