Skip to content
ENExplore Calculators

Risk Matrix Calculator

Score a 5×5 likelihood-versus-impact risk matrix, apply control effectiveness for residual risk and test it against your risk appetite.

About Risk Matrix Calculator

The multiplicative matrix keeps the two axes independent, so a catastrophic-but-rare risk (5 × 1) and a trivial-but-constant one (1 × 5) both score 5 — which is exactly the ambiguity a matrix is meant to expose rather than hide. Residual risk applies control effectiveness as a straight proportional reduction, and the required-effectiveness output inverts the same relationship to tell you how much control you still owe. A matrix score is the language your risk register, your board pack and your auditor all speak, and stating control effectiveness explicitly is what stops residual risk from being wishful thinking.

Formulas

Risk Matrix

Inherent risk = likelihood × impact on a 5×5 matrix; residual risk = inherent × (1 − control effectiveness); levels are 1–2 Very Low, 3–5 Low, 6–11 Medium, 12–19 High, 20–25 Extreme.

likelihood
1 Rare … 5 Almost certain
impact
1 Insignificant … 5 Catastrophic
control effectiveness
Fraction of inherent risk removed by existing controls
appetite
Highest residual score the organisation accepts

Control gap

Required control effectiveness = (inherent − appetite) ÷ inherent, the fraction of the risk you must remove to land inside appetite.

Worked example

With the default values below, Risk Matrix Calculator returns Inherent Risk Score of 16. Change any input above and every figure here is recalculated in your browser.

Inputs used

Likelihoodone of 1 — Rare (once in 10+ years), 2 — Unlikely (once in 3–10 years), 3 — Possible (once a year), 4 — Likely (several times a year), 5 — Almost certain (monthly or more)
4 — Likely (several times a year)
Impactone of 1 — Insignificant, 2 — Minor, 3 — Moderate, 4 — Major, 5 — Catastrophic
4 — Major
Control effectivenessaccepts 0–95 %
40 %
Risk appetite thresholdone of Averse — residual 4 or below, Cautious — residual 8 or below, Balanced — residual 12 or below, Open — residual 16 or below
Cautious — residual 8 or below

Results

Inherent Risk Score
16 / 25
Inherent Risk Level
High
Residual Risk Score
9.60 / 25
Residual Risk Level
Medium
Against Risk Appetite
Outside appetite — residual 9.6 exceeds 8
Recommended Treatment
Treat — add controls or formally accept with an owner and review date
Control Effectiveness Needed
50.0%

Step by step

  1. 1Values used
  2. 2Risk Matrix
  3. 3Control gap
  4. 4Inherent Risk Score= 16 / 25
  5. 5Inherent Risk Level= High
  6. 6Residual Risk Score= 9.60 / 25
  7. 7Residual Risk Level= Medium
  8. 8Against Risk Appetite= Outside appetite — residual 9.6 exceeds 8
  9. 9Recommended Treatment= Treat — add controls or formally accept with an owner and review date

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Risk Matrix calculated?

Inherent risk = likelihood × impact on a 5×5 matrix; residual risk = inherent × (1 − control effectiveness); levels are 1–2 Very Low, 3–5 Low, 6–11 Medium, 12–19 High, 20–25 Extreme. The multiplicative matrix keeps the two axes independent, so a catastrophic-but-rare risk (5 × 1) and a trivial-but-constant one (1 × 5) both score 5 — which is exactly the ambiguity a matrix is meant to expose rather than hide. Residual risk applies control effectiveness as a straight proportional reduction, and the required-effectiveness output inverts the same relationship to tell you how much control you still owe.

Why does Risk Matrix matter?

A matrix score is the language your risk register, your board pack and your auditor all speak, and stating control effectiveness explicitly is what stops residual risk from being wishful thinking.

What values do I need to enter?

This calculator takes 4 inputs: Likelihood, Impact, Control effectiveness, Risk appetite threshold. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Are 5×5 matrices statistically sound?

Not rigorously — ordinal scales multiplied together produce range compression and ties, and a quantitative model is better where you have data. Matrices survive because they are auditable and communicable; use one for triage and reach for expected-loss maths when the decision is expensive.

How do I justify a control effectiveness figure?

From evidence: test results, detection coverage, exercise outcomes. If you cannot point to a test, cap the figure at 50% — untested controls fail more often than teams assume.

Related Calculators

Risk Matrix Calculator – Calculate Inherent Risk Score