Work out risk likelihood and impact instantly with clear inputs, formula shown and shareable results.
The 5x5 risk matrix multiplies likelihood by impact to give an inherent score from 1 to 25, then reduces it by control effectiveness to give residual risk. The distinction matters for governance: inherent risk justifies why controls exist, and residual risk is what the risk owner is actually accepting. Reporting only one of the two hides either the exposure or the value of the controls.
Risk scoring
inherent = likelihood x impact; residual = inherent x (1 - control effectiveness)
Strictly no — multiplying ordinal ranks is mathematically questionable. They are used because they are quick and consistent. Quantitative methods such as ALE are more defensible where the data exists.
From evidence: test results, audit findings and incident history. A self-assessed percentage with no testing behind it makes residual risk fiction.