Build a clear likelihood × impact risk matrix in minutes. Add your risks, score them, and get a color-coded heat map with every risk plotted in its cell plus a sorted risk register, ready to drop into a report or slide as a PNG or PDF.
Last updated:
Everything is drawn in your browser. Nothing you type is uploaded.
Advertisement
Advertisement
How to use the Risk Matrix Generator
Enter a title and choose a 3 × 3, 4 × 4 or 5 × 5 grid and a color scheme.
Add your risks: a short ID, a description, the likelihood and impact levels, an owner and the planned mitigation.
Check the ratings: each risk's score (likelihood × impact) and rating update instantly. Adjust thresholds or level names under Axis labels if your organization uses different ones.
Review the heat map preview, with markers in each cell and the register sorted from highest to lowest score.
Download the PNG or PDF for your report, or the CSV to keep tracking risks in a spreadsheet.
Default 5 × 5 risk matrix scores
Each cell shows likelihood × impact. The default bands are Low (1–4), Medium (5–9), High (10–19) and Extreme (20–25).
Likelihood ↓ / Impact →
1 Insignificant
2 Minor
3 Moderate
4 Major
5 Severe
5 Almost certain
5
10
15
20
25
4 Likely
4
8
12
16
20
3 Possible
3
6
9
12
15
2 Unlikely
2
4
6
8
10
1 Rare
1
2
3
4
5
Typical responses by rating
Rating
Common response
Extreme
Act now: escalate to senior management, stop or redesign the activity until the risk is reduced.
High
Senior attention needed: assign an owner and a mitigation plan with deadlines; review often.
Medium
Manage with specific monitoring or controls; review regularly.
Low
Accept and manage with routine procedures; review periodically.
Responses vary by organization. Follow your own risk management policy where one exists.
Tips for a useful risk matrix
Write risks as cause → event → effect, for example "Supplier delay (cause) means parts arrive late (event), pushing launch back two weeks (effect)".
Define the levels in writing. Agree what "Likely" or "Major" means (a probability range, a cost or a delay) so different people score consistently.
Score as a group and revisit the matrix at each milestone; risks move as the project changes.
Do not ignore low-likelihood, severe-impact risks. They can score only Medium but still deserve a contingency plan.
Frequently asked questions
What is a risk matrix?
A risk matrix (also called a probability-impact matrix or risk heat map) is a grid with likelihood on one axis and impact or severity on the other. Each risk is placed in the cell matching its two ratings, and the cell color shows how serious it is, so the team can see at a glance which risks need attention first.
How is the risk score calculated?
This generator uses the common multiplication method: score = likelihood level × impact level. On a 5 × 5 matrix the scores run from 1 (rare and insignificant) to 25 (almost certain and severe). The score is then mapped to a rating band such as Low, Medium, High or Extreme.
What are the default rating bands?
On a 5 × 5 matrix: Low 1–4, Medium 5–9, High 10–19 and Extreme 20–25. On 4 × 4: Low 1–2, Medium 3–5, High 6–11, Extreme 12–16. On 3 × 3: Low 1–2, Medium 3–5 and High 6–9. You can change the minimum score for each band to match your organization's risk policy.
Should I use a 3x3, 4x4 or 5x5 matrix?
A 3 × 3 matrix is quick and good for small projects or workshops. A 5 × 5 matrix is the most widely used in project management, health and safety and enterprise risk because it separates risks more finely. A 4 × 4 matrix avoids a neutral middle level, which forces a decision either way.
What should a risk register include?
At minimum: an ID, a clear description of the risk (cause and effect), the likelihood and impact ratings, the resulting score and rating, the owner who is responsible, and the planned response or mitigation. Many teams also track the status, due date and a residual score after mitigation.
Can I show residual risk after mitigation?
Yes. A simple approach is to make two matrices: one with the inherent ratings before controls and one with the residual ratings after mitigation, using IDs like R3 in both so readers can see how each risk moves.
Is my risk data private?
Yes. The matrix is drawn in your browser and your risks are only saved in this browser's local storage so you can come back to them. Nothing is uploaded to a server.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.