Purpose of a Likelihood-Impact Matrix
A risk register can identify a risk and describe its likelihood and impact, but decision-makers also need a consistent way to summarize those assessments. A likelihood-impact matrix maps a risk’s two categories to a qualitative rating, such as Low, Moderate, High, or Very High. The rating can support discussion and prioritization, provided users understand what the matrix does—and does not—measure.
A matrix is a policy tool, not a universal scale. Its category thresholds and scoring rules should be specified for the organization and applied to a clearly stated time horizon and impact basis. The example scale in this tutorial is hypothetical. It is intended to demonstrate the method; another organization may reasonably choose different thresholds.
State the Scales Before Scoring
For the examples, assume a hypothetical organization assesses the probability of at least one occurrence during the next 12 months. For simplicity, impact is the financial loss from one occurrence, expressed in dollars. The organization has adopted the following categories. Lower bounds are included in the category shown; upper bounds are excluded unless the category has no upper bound.
| Likelihood code | Category | Annual probability |
|---|---|---|
| 1 | Rare | 0% to less than 0.01% |
| 2 | Unlikely | 0.01% to less than 0.1% |
| 3 | Possible | 0.1% to less than 1% |
| 4 | Likely | 1% to less than 10% |
| 5 | Almost certain | 10% or more |
| Impact code | Category | Financial loss from one occurrence |
|---|---|---|
| 1 | Negligible | Less than $100,000 |
| 2 | Minor | $100,000 to less than $500,000 |
| 3 | Moderate | $500,000 to less than $2,000,000 |
| 4 | Major | $2,000,000 to less than $10,000,000 |
| 5 | Severe | $10,000,000 or more |
These scales work only when the assessment matches their definitions. For example, an estimate of annual event frequency is not automatically the annual probability of at least one event. Nor should an assessor quietly switch between gross and net loss, or between one-event loss and a different impact basis. Record the applicable horizon and measure with the assessment.
Combining the Categories
One simple convention assigns the category codes 1 through 5 and calculates a score as their product. The score is then translated into a qualitative band according to the organization’s chosen cutoffs. In this example, scores 1–4 are Low, 5–9 are Moderate, 10–15 are High, and 16–25 are Very High.
Here \(L\) is the likelihood code, \(I\) is the impact code, and \(R\) is the matrix score. The matrix below shows the resulting score and band for every pair of categories.
| Likelihood \ Impact | 1 Negligible | 2 Minor | 3 Moderate | 4 Major | 5 Severe |
|---|---|---|---|---|---|
| 1 Rare | 1 Low | 2 Low | 3 Low | 4 Low | 5 Moderate |
| 2 Unlikely | 2 Low | 4 Low | 6 Moderate | 8 Moderate | 10 High |
| 3 Possible | 3 Low | 6 Moderate | 9 Moderate | 12 High | 15 High |
| 4 Likely | 4 Low | 8 Moderate | 12 High | 16 Very High | 20 Very High |
| 5 Almost certain | 5 Moderate | 10 High | 15 High | 20 Very High | 25 Very High |
The product rule has a useful ordering property. If a risk’s likelihood code increases while its impact code stays fixed, the product cannot decrease; the same is true if impact increases while likelihood stays fixed. For positive category codes, if \(L_2 \geq L_1\), then \(L_2I \geq L_1I\) for \(I>0\). Similarly, if \(I_2 \geq I_1\), then \(LI_2 \geq LI_1\) for \(L>0\). This explains why the rule preserves the direction of each category’s ordering. It does not establish that the product is a statistical risk measure: the category numbers are ordinal codes, and equal steps between codes need not represent equal changes in underlying risk.
State the time horizon, what counts as an occurrence, and the impact measure being categorized.
Compare the probability for the stated horizon with the documented likelihood boundaries.
Compare the assessed consequence with the impact boundaries, using the stated loss basis.
Record both categories, the score, and the qualitative band. Do not report only the band if the underlying assessment would be useful to readers.
Worked Assessments Near Category Boundaries
Worked Example: Just Below Two Thresholds
A hypothetical insurer assesses a data-transfer failure. Its estimated probability of at least one occurrence in the next 12 months is 0.099%. If it occurs, the financial loss is estimated at $499,999. Assign both categories and the matrix rating.
Method. Compare each estimate separately with the stated boundaries, then look up the product score.
Likelihood. The Unlikely category covers probabilities from 0.01% up to, but not including, 0.1%. Since \(0.01\% \leq 0.099\% < 0.1\%\), the likelihood code is \(L=2\).
Impact. The Minor category covers losses from $100,000 up to, but not including, $500,000. Since \(\$100{,}000 \leq \$499{,}999 < \$500{,}000\), the impact code is \(I=2\).
Score and rating. \(R=2\times2=4\). A score of 4 is Low under the stated band definitions.
Boundary check. If the assessed probability were exactly 0.1%, it would move to Possible; if the loss were exactly $500,000, it would move to Moderate impact. Both lower bounds are inclusive. The common mistake is to treat an exact boundary as belonging to the category below it. Applying the stated conventions, the original assessment is Unlikely, Minor, Low—not Possible, Moderate, Moderate.
Worked Example: Exact Lower Bounds
A hypothetical claims platform has a 1.00% probability of a specified outage during the coming year. The estimated loss if the outage occurs is exactly $2,000,000. Determine its matrix score and rating.
Method. Use the inclusive lower bounds in the category definitions before multiplying the codes.
Likelihood. Likely begins at 1%, inclusive. Therefore, \(1.00\%\) is in Likely, and \(L=4\).
Impact. Major begins at $2,000,000, inclusive. Therefore, the impact is Major, and \(I=4\).
Score and rating. \(R=4\times4=16\). Since scores from 16 through 25 are Very High, the rating is Very High.
Common mistake avoided. If an assessor incorrectly treated both lower bounds as exclusive, the estimates might be placed in Possible and Moderate, producing \(3\times3=9\), or Moderate. That calculation uses the wrong boundary convention. Exact equality belongs to the category whose lower bound includes it.
Worked Example: Converting an Annual Event Rate to a Probability
A hypothetical equipment fault is modeled as a Poisson event process with a constant rate of 0.02 events per year. Assume independent increments and a fixed rate over the coming year. If one or more faults occur, the estimated financial loss is $1,800,000. Find the likelihood category and matrix rating.
Method. First convert the Poisson event rate into the probability of at least one event in the one-year horizon. Then categorize that probability and the one-event impact.
Let \(N\) be the number of faults in one year. Under the stated Poisson model, \(P(N=0)=e^{-0.02}\). The event “at least one fault” is the complement of “no faults,” so
Likelihood. Since \(1\% \leq 1.98013\% < 10\%\), the probability is Likely, so \(L=4\).
Impact. Since \(\$500{,}000 \leq \$1{,}800{,}000 < \$2{,}000{,}000\), the impact is Moderate, so \(I=3\).
Score and rating. \(R=4\times3=12\), which is High.
Check and common mistake avoided. The calculated probability is positive and below 2%, as expected for a small annual rate; it is not exactly 2%. Substituting the rate 0.02 directly as a probability is incorrect because a rate and a probability are different quantities. In this case, both 1.98013% and the rough 2% would fall in Likely, but the conversion is still necessary to apply the method correctly.
What the Rating Can and Cannot Tell You
A matrix makes assessments easier to communicate and can help identify which risks warrant further discussion. The underlying categories remain important: two risks in the same band can have different likelihood-impact pairs, and the same score can arise from different combinations. For example, a score of 12 could result from Likely and Moderate or Possible and Major. Those combinations may call for different management responses even though the product is identical.
The score should not be interpreted as expected loss. Expected loss requires a probability and a loss amount on compatible definitions; a qualitative matrix instead combines category codes. Multiplying \(L\) and \(I\) does not convert those ordinal codes into a probability-weighted dollar estimate. Nor does a high score, by itself, quantify how much capital an organization needs.
A matrix also compresses information. It does not show the full range of possible outcomes or distinguish all risks within a category. If an estimate is close to a boundary, retain the underlying estimate and note the assigned category. This makes the assessment easier to review if assumptions or thresholds change. The boundary examples above show why an explicit rule for equality matters: a small change in an estimate, or an inconsistent reading of a threshold, can change the category and therefore the rating.
Common Mistakes
- Leaving the horizon unstated. A probability over one year cannot be compared consistently with a probability over a different period.
- Confusing rate and probability. For a Poisson process, a rate \(\lambda\) gives a probability \(1-e^{-\lambda}\) of at least one event over a one-year period, not automatically a probability equal to \(\lambda\).
- Changing boundary conventions mid-assessment. Decide whether each endpoint is included and apply the rule consistently.
- Treating the score as expected loss. Category codes and matrix bands are qualitative; their product is not a dollar-valued measure.
- Reporting only the color or band. Include the likelihood and impact categories so readers can understand how the result was produced.
Check Your Understanding
For each hypothetical assessment, use the category boundaries and scoring bands in this tutorial. State the categories, score, and qualitative rating where requested.
- A risk has a 0.009% annual probability and an estimated one-occurrence loss of $80,000. Assign the likelihood and impact categories, then give the score and band. (Answer: Rare, Negligible; score 1, Low.)
- A risk has a 0.10% annual probability and an estimated one-occurrence loss of exactly $500,000. Assign both categories and the matrix rating. (Answer: Possible, Moderate; score 9, Moderate.)
- A risk has a 0.8% annual probability and an estimated one-occurrence loss of $9,000,000. Find the likelihood code, impact code, score, and band. (Answer: Possible, Major; score 12, High.)
- A hypothetical event count follows a Poisson model with a constant rate of 0.095 events per year. The loss if at least one event occurs is $10,000,000. Convert the rate to the annual probability of at least one event, then assign the matrix rating. (Answer: \(1-e^{-0.095}\approx0.0906\), or 9.0628%; Likely, Severe; score 20, Very High.)
- Risk A has a 0.9% annual probability and a $1,900,000 loss if it occurs. Risk B has a 1.1% annual probability and a $600,000 loss if it occurs. For each, find the matrix score and band; also compare probability times loss. (Answer: A is Possible and Moderate, score 9, Moderate; probability times loss is $17,100. B is Likely and Moderate, score 12, High; probability times loss is $6,600. B has the higher matrix rating but the lower probability-times-loss value.)