A risk matrix plots risks by likelihood and impact to show which matter most. In a 5 by 5 matrix each risk scores from 1 to 25 (likelihood × impact). The result guides the response: avoid high likelihood, high impact risks; reduce frequent smaller ones; transfer rare but severe ones; accept minor ones.
How to build a risk matrix, step by step
- Identify risks from the case: strategic, operational, financial, compliance, reputational, IT.
- Rate likelihood from 1 (rare) to 5 (almost certain).
- Rate impact from 1 (insignificant) to 5 (catastrophic), considering money, safety, reputation and objectives.
- Score and plot: likelihood × impact.
- Choose a response for each risk and assign an owner.
- Monitor and re-score regularly, as risks move.
Risk responses: TARA
The book (Chapter 12) links each part of the map to a response:
| Response | When | Example |
|---|---|---|
| Avoid (terminate) | High likelihood and high impact | Stop selling a product that poses a serious safety risk |
| Reduce (treat) | High likelihood, lower impact | Regular maintenance to cut machine breakdowns |
| Transfer | Low likelihood, high impact | Insurance against fire or natural disaster; outsourcing |
| Accept (tolerate) | Low likelihood and low impact | Minor office supply price changes |
Worked example
| Risk for a heritage charity | Likelihood | Impact | Score | Response |
|---|---|---|---|---|
| Recession cuts donations | 4 | 4 | 16 | Reduce: diversify income, build reserves |
| Cyber attack exposes donor data | 3 | 5 | 15 | Reduce and transfer: IT controls plus cyber insurance |
| Storm damages a historic site | 2 | 5 | 10 | Transfer: insurance; reduce: maintenance |
| Volunteer shortage at small sites | 4 | 2 | 8 | Reduce: recruitment and training |
| Gift shop supplier price rise | 3 | 1 | 3 | Accept |
Based on the March 2025 pre-seen.
Risk matrix in ACCA SBL
Risk is syllabus area D. Typical tasks ask you to assess the main risks in the case and recommend responses. Rank risks with reasons from the case, not just labels; recommend a specific response and owner; and note where ratings are uncertain, which earns scepticism marks. Link to COSO ERM for the wider risk management framework.
Advantages
- Simple, visual and widely used
- Helps prioritise limited resources
- Easy for boards to understand
Limitations
- Ratings are subjective
- Different risks can share the same score
- Ignores links between risks
- Can create false precision
FAQs
What is a risk matrix?
A grid that plots risks by likelihood and impact so they can be compared and prioritised. A common version is 5 by 5, giving scores from 1 to 25.
How do you calculate a risk score?
Multiply the likelihood rating by the impact rating. For example, likely (4) × major (4) = 16, which is a high risk.
What is the difference between a risk map and a risk matrix?
They are often used interchangeably. A risk map is the overall picture of where an organisation's risks sit by likelihood and impact; the risk matrix is the grid used to draw it.
What are the four risk responses?
Transfer, avoid, reduce and accept (TARA), often called the 4Ts: transfer, terminate, treat and tolerate.
What are the limitations of a risk matrix?
Ratings are subjective, very different risks can get the same score, it ignores links between risks, and it can give a false sense of precision.