Risk matrix: how it works, with 3 real-world examples

Two things are true when it comes to making important decisions that impact your company.

1. You need a way to quantify risk to make the best choice.

2. You need to be able to explain that choice.

Once you make that decision, the next step is arguably to integrate a risk matrix. With that in mind, let's take a look at how to create a risk matrix that can identify exactly where best to manage risk.

What is a risk matrix?

A risk matrix helps you calculate risk across various outcomes and gives you clear guidelines on whether risk is acceptable or unacceptable.

How does a risk matrix work?

In simple terms, risk assessment equals the probability of an event multiplied by its impact. You can break levels of probability and impact into verbal and numerical scales like so:

The risk matrix then plots these variables in a color-coded chart to show the overall risk for different situations:

The quantified risk falls into one of three zones:

1. Low risk that’s considered acceptable (green)

2. High risk that’s considered unacceptable (red)

3. Moderate risk which may or may not be acceptable (yellow)

Whether risk is acceptable or not often comes down to a cost/benefit calculation. For example, it would be difficult to justify spending $2 million to prevent an ergonomic injury, whereas it would be worth it to prevent a chemical explosion.

There's a lot of variability in how to use a risk matrix, so here's a quick look at some examples.

1. Environmental health and safety

Let's say your company is trying to determine whether you need additional risk controls to prevent leakage of waste during transport via pipeline to a storage location.

The pipeline has had multiple maintenance issues, and it's located next to a regulated stream. You think it's likely some leakage may occur, and if it leaked you could end up killing off a population of endangered salamanders that live there.

Using the risk matrix example above and the automated risk assessment tools in your compliance or EHS management system, you flag this scenario as bordering on an unacceptable level of risk. With a high likelihood of occurrence and severe environmental consequences, the risk level lands in the red zone of the matrix. Based on this assessment, you decide to move forward with additional controls to mitigate the potential hazard.

2. Quality management and identifying risk

Let's say a supplier failure recently caused a problem at your company, and you must identify high-risk suppliers who need improvement (or who need to go altogether).

Your quality management system calculates each supplier's risk for you and shows that Supplier A has more incidents than Supplier B but poses less risk. This could be because Supplier B's product plays a strategic role in your process or consumer safety, while Supplier A's incidents have an overall negligible impact. You decide to focus your efforts on Supplier B.

3. Food safety

Here we'll use an example of a pathogenic hazard at a step where you're trying to decide whether you need another critical control point (CCP).

In this case, you set up your food safety management system (FSMS) to use a weighted scale rather than straight multiplication, where lower numbers represent a higher risk. Let's say internal policies dictate that anything that receives a risk rating of 1-10 needs a CCP. Based on how you plot the scales, you can see high risk at top left and low risk at bottom right in the example risk matrix below.

Since serious illness could occur and the situation is rated an 8, you will need an extra CCP. Your FSMS automatically feeds the information into your hazard analysis so you can record your decision.

Remember: the risk matrix is just a tool, not a solution. For true effectiveness, you need people on the other end who interpret the results, ask questions and vet your risk matrix by testing it against historical data. A safety culture built through digitalization sharpens that human judgment. With these pieces in place, the results prove powerful: they standardize your decisions and provide quantitative justification for them.

Learn more about reducing risk in your company with our free guidebook on how to define a risk management strategy.