Glossary

Likelihood and Impact Matrix

Tool for risk assessment combining probability and consequences for prioritisation.

A

B

C

D

E

F

G

H

I

J

K

L

A likelihood and impact matrix is a risk assessment tool that plots the probability of a risk event occurring against the severity of its potential consequences. Risks are typically scored on scales (e.g., 1-5 for both axes), producing a heat map that visually categorises risks as low, medium, high, or critical, enabling consistent and repeatable risk evaluation across the organisation.

This matrix is widely used in frameworks such as ISO 27005 and ISO 31000 to prioritise risk treatment efforts and allocate resources effectively. It supports informed decision-making during risk workshops and management reviews by providing a clear, visual summary of the organisation's risk landscape and highlighting which risks demand immediate attention.

M

N

O

P

Q

R

S

T

U

V

W

Z

Frequently asked questions

What is a likelihood and impact matrix?
A likelihood and impact matrix is a risk-assessment tool that plots the probability of a risk against its potential consequences, so risks can be prioritised.
How does a likelihood and impact matrix work?
Each risk is scored on how likely it is to occur and how severe the impact would be; the combined score places it in a grid, often colour-coded, that shows which risks to address first.
Why use a likelihood and impact matrix?
It gives a consistent, visual way to compare and prioritise risks, which is a core part of risk assessment under ISO 27001 and other frameworks.
← Back to all terms