Risk Matrix Calculator (5×5 Likelihood × Impact)
Score a risk on a 5×5 risk assessment matrix — likelihood × impact — before and after controls, with the risk level, the reduction achieved and the recommended response.
How it works
Risk score = Likelihood (1–5) × Impact (1–5) · Levels: 1–4 low, 5–9 medium, 10–16 high, 20–25 very high · Risk reduction = (Inherent − Residual) ÷ Inherent
A risk matrix combines how likely a hazard or event is with how bad its consequences would be. Multiplying 1–5 ratings for each gives a score from 1 to 25 that is banded into levels for prioritising action, as in ISO 31000-style enterprise risk management, project risk registers and workplace health and safety assessments. Scoring the risk again with the planned controls in place shows the residual risk and whether the controls are enough. Organisations calibrate their own descriptors and bands, so use your company’s definitions where they exist.
Worked example
A risk judged likely (4) with a moderate impact (3) scores 4 × 3 = 12, a high risk. After controls that make it unlikely (2) with the same moderate impact (3), it scores 6, a medium risk — a 50% reduction. The recommended response is to reduce it further where reasonably practicable and assign an owner.
Sources: ISO 31000 Risk management — guidelines · Risk matrix — design and limitations
Frequently asked questions
How do you calculate a risk score?
Multiply the likelihood rating by the impact (consequence) rating. On a 5×5 matrix, likely (4) × moderate (3) = 12.
What score is high risk on a 5×5 matrix?
A common banding is 1–4 low, 5–9 medium, 10–16 high and 20–25 very high (extreme). Your organisation may set different cut-offs or treat any catastrophic impact as high regardless of likelihood.
What is the difference between inherent and residual risk?
Inherent risk is the level before any controls; residual risk is what remains with the controls in place. The gap shows how much your controls are doing, and residual risk is what management must accept.
What are the limitations of a risk matrix?
Ratings are subjective and ordinal, so a score of 12 is not exactly twice as risky as 6, and very different risks can share a score. Use the matrix to prioritise and communicate, and quantify the biggest risks separately.
Related calculators
This calculator is for educational purposes. Double-check important results before acting on them.