Risk Likelihood And Impact Calculator
Work out risk likelihood and impact instantly with clear inputs, formula shown and shareable results.
About Risk Likelihood And Impact Calculator
The 5x5 risk matrix multiplies likelihood by impact to give an inherent score from 1 to 25, then reduces it by control effectiveness to give residual risk. The distinction matters for governance: inherent risk justifies why controls exist, and residual risk is what the risk owner is actually accepting. Reporting only one of the two hides either the exposure or the value of the controls.
Formula
Risk scoring
inherent = likelihood x impact; residual = inherent x (1 - control effectiveness)
Worked example
With the default values below, Risk Likelihood And Impact Calculator returns Residual risk score (1-25) of 6.00. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Likelihood (1-5)accepts 1–5
- 3
- Impact (1-5)accepts 1–5
- 4
- Control effectivenessaccepts 0–100 %
- 50 %
Results
- Residual risk score (1-25)
- 6.00
- Inherent risk score
- 12
- Reduction achieved by controls
- 6.00
- Risk band
- Medium - monitor with named owner
Step by step
- 1Values used
- 2Risk scoring
- 3Residual risk score (1-25)= 6.00
- 4Inherent risk score= 12
- 5Reduction achieved by controls= 6.00
- 6Risk band= Medium - monitor with named owner
Assumptions and limits
- The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Are ordinal scales like 1 to 5 statistically sound?
Strictly no — multiplying ordinal ranks is mathematically questionable. They are used because they are quick and consistent. Quantitative methods such as ALE are more defensible where the data exists.
How should control effectiveness be estimated?
From evidence: test results, audit findings and incident history. A self-assessed percentage with no testing behind it makes residual risk fiction.
Related Calculators
- Insider Threat Risk Score Calculator
- Risk Appetite Threshold Calculator
- Vulnerability Risk Priority Calculator
- WAF Rule Impact Calculator
- Access Review Effort Calculator
- Alert Triage Capacity Calculator
- Annualised Loss Expectancy Calculator
- Argon2 Parameters Calculator
- Audit Sample Size Calculator
- Backup Encryption Time Calculator
You might also need
- Risk Appetite Threshold CalculatorAlso in Security, Cryptography & Risk
- Vulnerability Risk Priority CalculatorAlso in Security, Cryptography & Risk
- WAF Rule Impact CalculatorAlso in Security, Cryptography & Risk
- Insider Threat Risk Score CalculatorAlso in Security, Cryptography & Risk
- Argon2 Parameters CalculatorAlso in Security, Cryptography & Risk
- Checksum Verification CalculatorAlso in Security, Cryptography & Risk
