A risk assessment answers two questions for every risk: how likely is it, and how bad if it happens? The 5×5 matrix turns those into a single score you can compare, rank, and act on — and a heat map anyone in the room can read at a glance.
Likelihood × impact
Score each risk 1–5 on how likely it is and 1–5 on how much it would hurt. Multiply the two (1–25) and the number falls into a band — Low, Medium, High, Critical. The band, not the raw number, is what drives the conversation.
Inherent vs residual
The score before you count your controls is the inherent risk. Apply how well your controls actually work and you get the residual risk — the one you're really carrying. A risk that looks Critical on paper may sit at Medium once strong controls are in; a risk with weak controls barely moves. Judging controls honestly is the whole game.
Inherent risk tells you the size of the problem; residual risk tells you the size of your exposure.
Reading the heat map
Plot each risk on the grid — likelihood up the side, impact across the bottom — and the colour tells you where to look first. It's the fastest way to show a board where the real concentration is without a spreadsheet.
Try it now — free.
Score your risks on the 5×5 matrix, apply your controls, set an appetite, and see the response for each one. Up to 10 risks, no account needed.
Open the free tool