Risk Matrix Maker
See your biggest risks at a glance. Score each risk by probability and impact — the matrix auto-plots them in a 5×5 heat map with colour-coded severity (Low to Critical). Add owners and mitigation plans, auto-saves in your browser, exports as SVG, PNG, JSON or text.
Auto-saved in your browser's localStorage on this device only. Nothing is uploaded.
How to use this risk matrix maker
- List every risk you can think of — technical failures, budget overruns, key person leaving, regulatory changes, vendor issues. Don't filter yet.
- Score each risk: probability (1 = rare, 5 = almost certain) and impact (1 = minor inconvenience, 5 = project failure). Be honest — underscoring probability is the most common bias.
- The matrix auto-plots risks by colour: green (Low), yellow (Medium), orange (High), red (Critical). Focus your mitigation budget on anything red or orange.
- Fill in the owner and mitigation fields. A risk without an owner is a risk nobody is managing. A mitigation without a cost estimate is wishful thinking.
- Export as PNG for a risk review meeting, or JSON to update the matrix next sprint.
Frequently asked questions
How is severity calculated?
Probability × Impact on a 5×5 grid. Scores 1-4 = Low (green), 5-9 = Medium (yellow), 10-15 = High (orange), 16-25 = Critical (red). This is the standard thresholding used in ISO 31000 and PMBOK.
Why a 5×5 grid instead of 3×3?
A 3×3 grid has only 9 cells and three risk levels — too coarse. Everything clusters in 'Medium'. A 5×5 grid has 25 cells and four severity levels, which gives enough spread to distinguish risks that need action from risks that just need monitoring. Going to 7×7 adds false precision without better decisions.
Should I score risks before or after mitigation?
Both. Score the inherent risk first (before any controls), then the residual risk (after planned mitigation). The gap between the two tells you if your mitigation is worth its cost. If a risk is Critical before and still High after your plan, you haven't mitigated enough.
Why do teams consistently underestimate probability?
Optimism bias. People score unlikely risks as 1 ('will never happen to us') when historical data says 2 or 3. The fix: don't ask 'how likely is this?' — ask 'has this ever happened at a company like ours?' If the answer is yes, it's at least a 2.
What's the difference between a risk matrix and a risk register?
A risk register is the full list — every risk with its description, owner, mitigation plan, status, dates. A risk matrix is the visual summary — a heat map showing where risks cluster by severity. This tool combines both: matrix view plus a list with owner and mitigation details.