Organizations map their residual risk scores onto a standardized matrix to visually highlight exposures that require immediate leadership attention. [1]
The 5 x 5 Strategic Risk Heat Map Matrix
Likelihood | Impact: 1 (Negl) | Impact: 2 (Minor) | Impact: 3 (Mod) | Impact: 4 (Major) | Impact: 5 (Cat)
-----------+------------------+-------------------+-----------------+-------------------+----------------
5 (Almost) | Medium           | High              | High            | Critical          | Critical
4 (Likely) | Medium           | Medium            | High            | High              | Critical
3 (Poss)   | Low              | Medium            | Medium          | High              | High
2 (Unlik)  | Low              | Low               | Medium          | Medium            | High
1 (Rare)   | Low              | Low               | Low             | Medium            | Medium

Institutional Risk Response Framework
  • Critical Matrix Zones: Requires immediate suspension of the activity until stronger controls are implemented.
  • High Matrix Zones: Requires executive intervention and monthly monitoring reports to the risk committee.
  • Medium Matrix Zones: Managed through standard operational reviews and routine control maintenance.
  • Low Matrix Zones: Accepted under standard operating procedures with annual control validations.

 
PreviousNext