How a 5×5 risk matrix works, and where it misleads

How the 5×5 risk matrix works

The matrix has probability on one axis and impact on the other, each scored 1 (very low) to 5 (very high). The steps:

1. Define the scales. Give each score a range: probability as a percentage band, impact as a cost, delay or quality band. Without written ranges, people score by feel.
2. Score each risk. Pick the probability score and the impact score on the objective hit hardest.
3. Multiply. Score = P × I, from 1 to 25.
4. Place and colour. The cell's colour band sets the priority and the expected treatment.
5. Act by band. Agree in advance what each band means: who must be told, how fast a response is needed.

Here is the full grid of scores:

Probability \ Impact	1	2	3	4	5
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15
2	2	4	6	8	10
1	1	2	3	4	5

Colour bands and what to do in each

A common banding (an example, set your own) is:

Band	Scores	Typical treatment
Low (green)	1 to 4	Accept and monitor at regular reviews
Medium (yellow)	5 to 9	Owner plans a response; review monthly
High (amber)	10 to 14	Active response with a due date; report to sponsor
Very high (red)	15 to 25	Immediate action; escalate; consider stopping the affected work

Many organisations also treat any impact of 5 as at least high, whatever the probability. That rule catches rare catastrophic events that a pure product would leave in a low band, and it fixes one of the problems below.

Worked example: four risks, two rankings

Score four risks with these scales: probability 1 under 10%, 2 from 10% to 30%, 3 from 30% to 50%, 4 from 50% to 70%, 5 over 70%; cost impact 1 under $5,000, 2 from $5,000 to $10,000, 3 from $10,000 to $25,000, 4 from $25,000 to $50,000, 5 over $50,000.

Risk	Estimate	P	I	Score	Band	EMV
R1	60%, $12,000	4	3	12	High	$7,200
R2	20%, $40,000	2	4	8	Medium	$8,000
R3	5%, $200,000	1	5	5	Medium	$10,000
R4	80%, $2,000	5	1	5	Medium	$1,600

The EMVs: 0.60 × $12,000 = $7,200; 0.20 × $40,000 = $8,000; 0.05 × $200,000 = $10,000; 0.80 × $2,000 = $1,600. Ranked by score, the order is R1, R2, then R3 and R4 tied. Ranked by EMV it is R3, R2, R1, R4: almost the reverse. R3 and R4 share a score of 5, yet R3's expected cost is more than six times R4's, and R3 alone could wipe out a typical contingency. The severity override (impact 5 is at least high) lifts R3 to where it belongs. The expected cost of all four is $26,800, a total you can only get from the EMVs, never from the scores.

Where the 5×5 matrix misleads

1. Equal scores, very different risks

Take a typical scale where probability 5 means over 70%, probability 1 means under 10%, impact 1 means under $5,000 and impact 5 means over $50,000. Now compare two risks:

• Risk A: P = 5, I = 1, score 5. Say 80% × $3,000 = EMV $2,400.
• Risk B: P = 1, I = 5, score 5. Say 5% × $400,000 = EMV $20,000.

Same score, same colour, yet B's expected cost is more than eight times A's, and B could end the project. The matrix cannot tell them apart.

2. Bands hide size

"Impact 5" covers $50,001 and $5 million alike. The open-ended top band is exactly where the dangerous risks live.

3. Cliff edges

A probability of 29% scores 2 and 31% scores 3. Tiny differences in judgement move a risk across a colour boundary, while large differences inside a band change nothing.

4. Scores are labels, not quantities

Only 14 distinct scores are possible (1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20, 25). A score of 12 is not "twice as risky" as 6. You cannot add scores to get a project total or average them across a portfolio. Add EMVs and expected days instead.

5. No timing, no links

The matrix shows neither when a risk could occur nor which activities it hits. A medium risk on the critical path next week may matter more than a high risk on a task with months of float.

How to use the matrix well

• Write the scales down with numeric ranges, and size the impact bands to your project.
• Record the numbers behind the score. Keep the probability percentage and the cost and delay estimate next to the 1 to 5 scores, so you can compute EMV.
• Override for severity. Treat impact 5 as high or above regardless of probability.
• Use it to triage, not to total. The matrix decides which risks get attention this week. EMV and schedule risk analysis decide reserves and dates.
• Plot opportunities too, on a mirrored matrix or with a separate marker, so they get owners and actions.
• Move to quantitative analysis when dates and budgets carry real consequences. A Monte Carlo schedule analysis shows the combined effect of all risks on the finish date; see the Monte Carlo P80 guide.

How to do this in Critova

Critova shows the risk register on a clickable 5×5 matrix: click a cell to see the risks in it, then open any one to update its owner, response or due date. Each risk also carries cost and schedule exposure and its EMV, so the numbers sit right beside the colour, which covers the biggest weakness above. When you need more than triage, attach risk events to schedule activities and run the Monte Carlo analysis for P50, P80 and P90 dates and the risk drivers. To test a single risk's score and EMV first, use the free risk score calculator.