Purpose: A heat map summarizes relative ratings. It is useful for grouping and discussion, but the color is not the risk. Every cell should lead back to a scenario, evidence, owner, and decision.
Build the map carefully
Define likelihoodUse written descriptions for each level, including time horizon and evidence expectations.
Define impactDescribe operational, financial, customer, legal, safety, or strategic consequences consistently.
Set combination rulesExplain how likelihood and impact produce a band and where judgment can override the matrix.
Preserve the scenarioNever separate the plotted point from the risk statement and assumptions.
Show movementRecord why a risk moved and whether the change reflects exposure, evidence, or methodology.
Worked examples
| Example | Context / Rating | Condition / Safeguard | Decision / Result | Owner / Follow-up |
|---|
How to use this page
- Agree on definitions before plotting risks.
- Calibrate with sample scenarios from different teams.
- Use the matrix as one input, not the final decision.
- Add confidence or uncertainty where evidence is weak.
- Review clustering that may reveal scoring habits rather than actual exposure.
Cautions
- Colors can create false precision and emotional bias.
- Two risks in the same cell may have very different consequences or urgency.
- Never average away a severe impact merely because likelihood appears low.
Educational use: Tailor the language and decision authority to the organization. This page is not a certification, legal opinion, security assessment or substitute for professional advice.
Frequently asked questions
Can a small organization use this tool?
Yes. Reduce the number of fields or questions, but retain the scenario, business consequence, accountable owner, decision and review date.
Does this replace professional advice?
No. It is an educational structure. Legal, insurance, compliance, cybersecurity and other professional decisions may require qualified advice.
How often should it be updated?
Update it when the related service, supplier, data, threat conditions, controls, incident history or business priorities change materially.