How to Score Risks with a Probability and Impact Matrix

## The short answer

To score a risk, rate two things on a simple scale: how **likely** it is to happen and how **severe the impact** would be if it did. Multiply (or combine) the two to get a risk score, then plot it on a grid known as a probability and impact matrix. The score tells you where the risk sits, red, amber or green, and therefore how much attention and mitigation it deserves. The goal is not mathematical precision; it's a consistent, defensible way to rank risks so the team spends effort where it matters.

## Step one: agree your scales

Most teams use a 1-to-5 scale for each dimension, though 1-to-3 works fine for smaller projects. Crucially, define what each level *means* in words so two people scoring the same risk land in roughly the same place.

**Likelihood** (example definitions):

- 1 — Rare: very unlikely within this project

- 2 — Unlikely: could happen but not expected

- 3 — Possible: realistic chance

- 4 — Likely: more probable than not

- 5 — Almost certain: expect it unless we act

**Impact** (example dimensions to consider): effect on schedule, cost, quality, reputation or safety. Define what a "3" looks like for each, for instance a moderate schedule slip versus a critical one.

## Step two: score each risk

For every risk in your log, assign a likelihood number and an impact number. Then combine them. The two common approaches are:

- **Multiplication**: likelihood × impact. A 4 × 5 risk scores 20; a 2 × 2 risk scores 4. This spreads scores out and emphasises high-high risks.

- **Matrix banding**: plot the pair on a grid and read off a colour band (red/amber/green) without doing arithmetic.

Both are valid. Multiplication gives you a sortable number; banding is more intuitive for stakeholders.

## Step three: read the matrix

Picture a 5×5 grid with likelihood on one axis and impact on the other. Conventionally:

- **Top-right (high/high)** — red. These need active mitigation now and senior visibility.

- **Middle band** — amber. Manage and monitor; have a plan.

- **Bottom-left (low/low)** — green. Accept and review periodically.

The colour bands turn a wall of numbers into an instant priority order anyone can grasp.

## Inherent vs residual risk

A point teams often miss: score the risk **twice**.

- **Inherent risk** is the score *before* any mitigation, how bad it is if you do nothing.

- **Residual risk** is the score *after* your planned mitigations take effect.

The gap between the two shows whether your mitigation is actually worth the effort. If residual is barely lower than inherent, your plan isn't doing much.

## Common scoring mistakes

- **Everything is a 4 or 5.** When every risk looks critical, the matrix loses meaning. Force differentiation by comparing risks against each other.

- **Vague scales.** "High impact" means different things to different people. Anchor each level with concrete descriptions.

- **Scoring once and forgetting.** Likelihood and impact change as the project moves. Re-score during reviews.

- **Ignoring proximity.** A high-impact risk that could hit next week deserves more urgency than one that's a year away, even at the same score. Consider tracking proximity alongside the score.

- **False precision.** A score of 16 is not meaningfully "better" than 15. Use scores to band and rank, not to pretend at accuracy.

## Turning scores into action

A score is only useful if it drives a decision. For each banded risk, choose a response:

- **Avoid** — change the plan so the risk can't occur.

- **Reduce** — take action to lower likelihood or impact.

- **Transfer** — shift it to a third party, for example via a contract or insurance.

- **Accept** — consciously tolerate it, usually for low-scoring risks.

Then make sure each red and amber risk has a named owner and a dated action in your RAID log.

At neart.ai we build enterprise-grade delivery and PMO products, and one consistent lesson is that the scoring scale matters less than using it consistently. A simple 1-to-5 matrix applied honestly every week beats an elaborate model applied once.

## Practical takeaway

Define clear word-based scales for likelihood and impact, score every risk for both inherent and residual exposure, and let the red/amber/green bands set your priorities. Re-score at each review, and never let "everything is critical" hollow out the matrix.