Learn how to assess risk likelihood and impact, build a 5×5 risk matrix, justify risk scores and understand the limitations of qualitative scoring through practical examples.
A common activity in Governance, Risk and Compliance (GRC) is assessing how likely a risk event is to occur and how seriously it could affect an organisation.
Many organisations use a risk matrix to support this process.
For example, a GRC analyst might assess a potential ransomware incident as having a likelihood of 4 and an impact of 5, producing a risk score of 20.
But what do those numbers actually mean?
Why is the likelihood 4 rather than 3? What evidence supports an impact rating of 5? And does a score of 20 mean the organisation faces twice as much risk as one with a score of 10?
These questions matter because risk scoring can create an appearance of precision even when the underlying assessment is highly subjective.
This guide explains how likelihood and impact scoring works, how to construct a practical risk matrix, how to justify ratings and how to avoid common mistakes.
We'll use a fictional financial technology company, Meridian Financial Services Ltd, to demonstrate the process.
Risk scoring is a technique used to express the assessed significance of a risk using defined criteria.
One widely used qualitative approach evaluates two dimensions:
A common scoring convention is:
Risk score = Likelihood × Impact
For example:
Likelihood = 3
Impact = 4
Risk score = 3 × 4 = 12
The resulting score can help categorise risks and support prioritisation.
However, multiplying qualitative ratings does not produce a scientifically measured quantity of risk.
A score of 20 does not necessarily represent twice the financial exposure, probability or expected loss associated with a score of 10.
The value of the method comes from consistent criteria, transparent reasoning and informed decision-making.
Before assigning scores, the analyst must understand what each dimension measures.
Likelihood concerns the chance that a specified risk event will occur within the assessment's defined time horizon.
Relevant considerations may include:
For example, an internet-facing application with known exploitable vulnerabilities may have a different likelihood of compromise from an isolated internal system.
However, exposure alone does not establish a precise probability.
The analyst should document assumptions and evidence.
Impact concerns the consequences if the risk event occurs.
Depending on the organisation, relevant impact dimensions may include:
An organisation should define how these dimensions are assessed and combined.
For example, a risk might have limited financial consequences but severe regulatory or customer impacts.
An assessment methodology may use the highest credible impact dimension, a defined aggregation rule or another approved approach.
The analyst should not invent a combination method for each individual assessment.
A five-point scale is commonly used because it provides enough differentiation for many qualitative assessments without requiring excessive complexity.
Here is an illustrative example.
| Score | Rating | Suggested interpretation |
|---|---|---|
| 1 | Rare | Exceptional event, considered highly unlikely within the assessment period |
| 2 | Unlikely | Credible but not expected under normal circumstances |
| 3 | Possible | Could occur under reasonably foreseeable conditions |
| 4 | Likely | Expected under several plausible conditions |
| 5 | Almost certain | Expected to occur frequently or imminently |
These descriptions are useful as a starting point, but they are not sufficient for every organisation.
Likelihood should be assessed against a consistent period.
For example:
What is the likelihood of this event occurring within the next 12 months?
Without a time horizon, two analysts might reach different conclusions because one is considering a year while another is considering five years.
Suppose a payment platform has experienced three significant availability incidents in the past year.
This information may support a higher likelihood rating for certain disruption scenarios.
However, the analyst must consider whether those incidents are comparable to the event being assessed.
Three minor outages do not automatically establish the likelihood of a catastrophic regional infrastructure failure.
Some organisations use probability ranges to define likelihood categories.
For example, a methodology might associate each rating with a probability interval over a defined period.
Such ranges should be calibrated to the relevant risk types and supported by data or expert judgement.
Do not assign arbitrary percentage ranges merely to make a qualitative assessment appear quantitative.
Impact scales should reflect the organisation's size, objectives, obligations and risk-bearing capacity.
A £100,000 loss may be manageable for one organisation and existential for another.
Therefore, impact thresholds should be organisation-specific.
| Score | Rating | Illustrative consequence |
|---|---|---|
| 1 | Insignificant | Negligible disruption or loss |
| 2 | Minor | Limited consequences managed through routine operations |
| 3 | Moderate | Material disruption requiring management intervention |
| 4 | Major | Significant consequences affecting important business objectives |
| 5 | Severe | Critical consequences threatening essential services or organisational objectives |
This is a simplified training scale.
In practice, an organisation should define more specific thresholds.
Meridian Financial Services Ltd operates digital payment services.
Its operational impact criteria might include:
| Score | Illustrative service disruption |
|---|---|
| 1 | Brief degradation with negligible customer impact |
| 2 | Limited disruption affecting a small customer group |
| 3 | Material interruption requiring coordinated recovery |
| 4 | Extended disruption affecting a significant proportion of customers |
| 5 | Critical interruption of essential payment services with severe business consequences |
These descriptions would need further calibration before formal use, including appropriate duration, customer-impact and recovery thresholds.
Consider a customer information breach.
The financial consequences might initially appear moderate, while regulatory and customer consequences could be severe.
The organisation's approved methodology should explain how to determine the overall impact rating.
A common approach is to use the highest credible impact across defined dimensions, but this is not the only valid method.
Whichever approach is chosen, apply it consistently.
A risk matrix combines likelihood and impact ratings to produce a visual representation of assessed exposure.
The example below uses five likelihood levels and five impact levels.
{@body /* static publication matrix */ }
| Likelihood ↓ / Impact → | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 — Almost certain | 5 | 10 | 15 | 20 | 25 |
| 4 — Likely | 4 | 8 | 12 | 16 | 20 |
| 3 — Possible | 3 | 6 | 9 | 12 | 15 |
| 2 — Unlikely | 2 | 4 | 6 | 8 | 10 |
| 1 — Rare | 1 | 2 | 3 | 4 | 5 |
Each cell is calculated by multiplying the likelihood and impact ratings.
For example:
Organisations often group the scores into categories such as Low, Medium, High and Critical.
For illustration, consider the following thresholds:
| Score | Illustrative band |
|---|---|
| 1–4 | Low |
| 5–9 | Medium |
| 10–16 | High |
| 17–25 | Critical |
These are example thresholds, not universal standards or necessarily the thresholds configured in the GRC Workshop ERM Toolkit.
The organisation should approve its own risk bands and explain how they relate to escalation and decision-making.
Important: A risk rating is not the same as risk appetite. A High-rated risk may be within an organisation's approved appetite in one category and unacceptable in another.
Try changing the likelihood and impact ratings below to see how the score changes.
Interactive exercise: Select likelihood and impact scores from 1 to 5, then calculate the product using the risk matrix above.
Consider these questions:
For example, a likelihood of 2 and impact of 5 produces a score of 10.
A likelihood of 5 and impact of 2 also produces a score of 10.
Yet the first scenario describes a relatively unlikely event with severe consequences, while the second describes a much more frequent event with limited consequences.
These risks may require very different controls and management responses.
This is one of the limitations of relying on a single numerical score.
Let's apply the methodology to a realistic scenario.
Meridian Financial Services Ltd operates a cloud-hosted payment platform.
The company depends on its primary cloud environment to process customer transactions.
A recent internal review identified that the disaster recovery plan has not been tested against the current production architecture.
Following a significant disruption to the primary cloud environment, unverified disaster recovery arrangements could prevent the timely restoration of payment services, resulting in prolonged transaction disruption, financial losses and contractual consequences.
For this exercise, assume the analyst assigns:
Likelihood = 4 (Likely)
The rationale is based on the fictional scenario's exposure assumptions and Meridian's reliance on its primary environment.
In a real assessment, this rating would require further justification. An untested recovery plan alone does not demonstrate that a major cloud disruption is likely to occur.
The analyst assigns:
Impact = 5 (Severe)
A prolonged interruption of critical payment services could have significant consequences for customers and the organisation.
4 × 5 = 20
Under the illustrative risk bands in Section 5, this is Critical.
Meridian has:
However, recovery arrangements have not been validated against the current architecture.
Assume the available evidence supports a provisional residual assessment:
Residual likelihood = 3
Residual impact = 5
Residual score:
3 × 5 = 15
Under the illustrative bands in Section 5, this is High.
The impact remains severe because the organisation has not demonstrated that it can restore services within the required timeframe.
| Assessment field | Result |
|---|---|
| Risk | Cloud service disruption |
| Inherent likelihood | 4 |
| Inherent impact | 5 |
| Inherent score | 20 |
| Residual likelihood | 3 |
| Residual impact | 5 |
| Residual score | 15 |
| Key uncertainty | Recovery performance not validated |
| Recommended action | Conduct an end-to-end disaster recovery exercise |
The ratings are illustrative and should not be interpreted as measured incident probabilities.
One of the most important responsibilities of a GRC analyst is explaining why a rating was selected.
A score without a rationale is difficult to challenge, approve or reassess.
Likelihood = 4 because the risk is high.
This is circular reasoning.
It does not explain the evidence supporting the assessment.
Likelihood = 4 because the assessed scenario involves multiple exposed dependencies, previous comparable disruption events and unresolved weaknesses that increase the plausibility of the event within the defined assessment period.
This is more defensible, provided those conditions are supported by evidence.
Depending on the risk, supporting information might include:
Sometimes the analyst cannot obtain enough information to support a confident rating.
Do not conceal this uncertainty.
Record:
Where the methodology requires it, an incomplete assessment may need to remain provisional rather than being treated as an approved residual risk position.
Risk scoring helps describe exposure.
Risk appetite helps determine whether that exposure is acceptable under the organisation's approved criteria.
These are different activities.
Consider Meridian's fictional Operational risk thresholds:
| Criterion | Score |
|---|---|
| Risk appetite | 9 |
| Risk tolerance | 15 |
| Assessed residual risk | 15 |
Under this fictional methodology, the residual score exceeds appetite but remains within the tolerance limit.
The appropriate classification is an appetite breach.
This should prompt the required governance response, which may include escalation, treatment planning or an authorised risk decision.
A risk matrix might classify a score of 15 as High.
But the appetite decision depends on the approved threshold for the relevant category.
An organisation could establish different appetite thresholds for operational, strategic, financial or compliance risks.
Do not assume that every High-rated risk automatically breaches appetite.
Risk matrices are useful, but they have limitations that practitioners should understand.
The difference between likelihood ratings 1 and 2 is not necessarily equivalent to the difference between ratings 4 and 5.
Multiplying ordinal categories is a convention rather than a mathematically precise measurement of exposure.
A rare catastrophic event and a frequent low-impact event may produce identical scores.
They may still require different management attention.
Two analysts may select different scores because they interpret the evidence differently.
Clear criteria, calibration exercises and review processes can improve consistency.
A single rating can make an uncertain assessment appear definitive.
Document important assumptions and evidence limitations.
Adding qualitative risk scores across a register does not produce a valid measure of total organisational loss exposure.
Risk aggregation requires appropriate methods that consider dependencies, correlations and the nature of the underlying measures.
Some scenarios require more detailed techniques, such as:
The method should be proportionate to the decision and the quality of available information.
Without a consistent methodology, scores become difficult to compare.
Frequent cyberattacks do not automatically mean a specific risk scenario is highly likely to succeed.
Controls may influence one dimension but not the other.
A control should not receive credit simply because it appears in a policy document.
A score of 20 is not equivalent to £20 million, a 20% probability or any other quantitative measure unless a separately justified model explicitly establishes such a relationship.
The same event may have different consequences for different organisations.
Likelihood and impact assessments may become outdated as threats, business activities and controls change.
Imagine you are a GRC analyst at Meridian Financial Services Ltd.
Assess the following scenarios using the illustrative five-point scales from this article.
Some emergency administrative accounts are excluded from multi-factor authentication.
Access reviews are inconsistent, but privileged activity is logged.
Your task:
Meridian depends on a third-party provider for a critical payment function.
The provider has experienced service disruptions, and the organisation has limited alternative processing capability.
Your task:
Assess the likelihood and impact of a material supplier outage and explain how dependency concentration affects the assessment.
A compliance team relies on manual spreadsheets to track regulatory reporting deadlines.
The process has no independent review and has previously experienced late submissions.
Your task:
Assess the likelihood and impact of a future reporting failure, identify relevant controls and recommend appropriate treatment.
Before completing each assessment, confirm that:
There is no universally correct score for these fictional scenarios.
The quality of your assumptions, evidence and reasoning determines the defensibility of the assessment.
The GRC Workshop Enterprise Risk Management Toolkit provides a structured Excel environment for applying risk assessment concepts.
Using the workbook, you can:
Start with the Sample ERM Workbook to explore completed fictional examples.
Then use the Clean ERM Template to practise scoring your own risk scenarios.
The ERM Toolkit Quick-Start Guide provides a practical walkthrough of the workbook.
Likelihood and impact scoring provides a structured way to analyse and communicate risk.
A useful risk matrix depends on clearly defined criteria, consistent application and credible evidence.
The resulting score can support prioritisation, but it should not be mistaken for a precise probability or financial loss estimate.
GRC analysts should be able to explain the assumptions behind every rating, evaluate the effectiveness of relevant controls and connect the assessment results to organisational risk appetite.
The objective is not to produce a number. It is to support a defensible risk management decision.