How to Use a Risk Matrix in Project Management (2024)

Within the perform qualitative risk assessment process, each identified risk’s probability and impact score is mapped within the risk matrix tool to help the Project Manager and team better understand how certain risks may impact the project. The risk matrix tool communicates the overall project risks and supplies information, increasing the effectiveness of a risk response. Students preparing for Project Management Institute (PMI) exams and project managers refining their skills should know what a risk matrix is and how it benefits the project.

Students should know PMI’s Project Management Professional (PMP)® exam uses the term “probability and impact matrix.” However, some project managers informally call it the: risk control matrix, risk matrix, PMP risk matrix, risk matrix PMP, or probability and impact matrix PMP. The term “risk matrix” or “risk matrix PMP” will be used for simplicity.

On this page:

• What is a PMP Risk Matrix?
• When to use a Risk Matrix
• Probability and Impact Matrix PMP
• Risk Matrix elements
• How to create a Risk Matrix
• Risk Matrix advantages and disadvantages
• Summary

Get Your Comprehensive Guide to Risk Management

Learn how to manage risk in every project.

What is a PMP Risk Matrix?

PMI’s “risk probability and impact assessment” description states:

• Consideration of the likelihood a specific risk will occur
• Consideration of the potential effect on schedule, cost, quality, or performance
• Impacts will be negative for threats (negative risk)
• Impacts will be positive for opportunities (positive risk)

Qualitative risk assessment uses the risk matrix tool to understand project risk better. During the risk assessment, risks are identified and documented. The assessment of each identified risk includes determining the probability and impact of it and assigning values. Project managers then calculate risk scores to plot in a risk matrix to create a holistic visual representation of project risk.

The risk matrix’s visual depiction conveys the project’s risks, so the project manager and team are better positioned to determine risk mitigation and response strategies.

When to use a Risk Matrix

Project managers should complete a risk matrix as part of the perform qualitative risk analysis process. The risk matrix tool fits within the overall risk management knowledge area, specifically the early risk processes. After the perform qualitative risk analysis process, each risk’s probability and impact are documented in the risk matrix tool.

Probability and Impact Matrix PMP

Risk probability is the likelihood of occurrence or what are the chances of that risk happening within the time frame of the project. Risk impact refers to the level of disturbance to the project if a risk occurs. Probability and impact are used in conjunction because you can have a risk that will most certainly happen (high probability) but with little measurable change for the project (low impact). Or vice versa, a risk is most unlikely to occur (low probability), but the project will suffer (high impact) if it does happen.

The definitions of probability and impact levels are determined as part of the initial risk assessment. For all risk assessments, the quality of the data used directly correlates to the effectiveness of the resulting project decisions.

The value scale for probability and impact is also tailored to the specific project within the early risk assessment work. Probability and impact definitions and the corresponding values for each should be determined early in the project and consistent throughout the project. Like the definitions, the value range for probability and impact is tailored to the specific project’s scope.

Risk Matrix elements

The risk matrix is also called a probability and impact matrix because the two axes must be probability and impact, even if different words are used.

• axis for probability, values from low to high
• axis for impact, values from low to high
• indicators across the matrix of risk scores to signal the level of significance

Companies with formalized risk assessments have risk matrix templates to reflect their project types or industry. Any risk matrix should reflect these elements:

Probability (or Likelihood) on X-Axis

The X-axis should be labeled appropriately to include the scale of values.

• Probability axis label: probability, likelihood, or likelihood of occurrence
• Probability axis scale intervals:
  • low, medium, high
  • unlikely, possible, likely
  • highly improbable, improbable, unlikely, probable, highly probable

Impact on Y-Axis Examples

The Y-axis should be labeled to include the rating scale.

• Impact axis label: impact, consequence, possible consequence, or severity
• Impact axis value scales:
  • low, medium, high
  • minor, moderate, major
  • insignificant, minor, moderate, major, significant

In the probability and impact matrix, both metrics must have the same number of intervals for calculations and valid assessment to be possible. For example, there cannot be three intervals for probability (X-axis) and five for impact (Y-axis). A risk matrix is usually a 3 x3, 4×4, or 5×5 grid to easily fit on one page and convey the core information visually. The more intervals used, the more specific the valuation of risk. However, be aware that a bigger scale does not equate to more accuracy. For example, a scale range of 100 values will add complication without adding accuracy to your risk management work.

How to create a Risk Matrix

Unless there is company-required software, any spreadsheet tool (Microsoft Excel or Google Sheets, for example) can be used to create a risk matrix. PMI’s A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth edition (page 423) lists a four-step process: Risk Identification, Risk Analysis, Assessing Risk Impact Level, and Risk Prioritization.

Step 1: Risk Identification

To identify risks, the project manager and team carefully review project objectives: scope, budget, timeline, goals, and resources. From that, the identified risks are documented in the risk register.

Step 2: Risk Analysis

Each project should have tailored definitions of risk probability and impact to increase accuracy in risk assessment and management efforts. The project manager works with the team and stakeholders to define risk probability and values in addition to the risk impact and measurement for the project.

Each risk will have a probability value for how likely it is believed it could occur. In risk analysis, interviews with experts within and outside the project help determine that likelihood.

Step 3: Assessing Risk Impact Level

Each risk also has an impact value for how significant it will be to the project if it occurs. The project’s definition of risk impact, including the values assigned for different levels, is used in interviews and meetings with those familiar with the project type to determine the final impact level assigned.

Step 4: Risk Prioritization

With the identified risks now having a probability value and an impact value assigned, within the specific project’s parameters, the risk matrix tool is ready for risk prioritization. Each risk’s probability value is multiplied by its impact value to calculate the probability and impact score for plotting on the matrix.

Risk Matrix output

With the probability and impact scores plotted on the matrix, the project manager can assign labels to zones to help clarify the range of risk. The labels can be a combination of text and colors to convey ranking:

• Low: the color green and text label of “low”
• Medium: the color yellow and the label of “mid”
• High: the color red and the text label of “high”

The low zone should be in the opposite corner of the high. The risk matrix output is a heatmap of risk severity across the project.

Project managers should not depend on color alone to communicate the ranking considering color blindness and the different meanings associated with colors. Do not assume everyone can see red or that the color red means “danger” for everyone. Better to use both text and color for better project team communication.

Risk Matrix as an input

The project manager gains insight into the amount and range of project risk by plotting each risk’s probability and impact score on the risk matrix. The project manager, team, and stakeholders use the risk matrix to group the risks with the most and the least severity to plan accordingly.

Risk Matrix advantages and disadvantages

The risk matrix tool fits within risk assessment and is a simple and quantitative way of evaluating project risk. It evaluates risks based on their probability of occurrence and the potential impact on the project.

Advantages of Risk Matrix

When used correctly, including with verified and high-quality data, the risk matrix helps the project manager with these critical tasks and decisions:

• prioritizing all risks to gain an understanding of the level of severity
• informing more accurate risk management strategies
• providing low-cost means to conduct risk analysis
• allocating appropriate levels of resources for risk
• increasing or decreasing the impact of a risk that does occur

A well-constructed risk matrix is an advantage to the project team in these ways:

• a visual depiction of risk across the project conveying the significance
• a means to help the team understand risk across the project
• identification of areas for which risk is highest
• information to help better allocate resources for risk

The well-constructed risk matrix is a tool to help the project manager and project team better reach the project goals as planned.

Disadvantages of Risk Matrix

Project managers need to know the disadvantages as well as the advantages of the risk matrix. One inherent disadvantage of the probability and impact risk matrix is the potential exclusion of qualitative risk characteristics and their potential impact. Project managers should use qualitative and quantitative data whenever possible to increase objectivity and accuracy.

For the project, potential disadvantages of the risk matrix tool include:

• Matrix categories lack the needed level of specificity to enable accurate risk ranking
• Poor quality data used for values results in inaccurate probability and impact scores
• Failure to account for the timing of the risk occurring in terms of the potential impact of it
• Overall subjectivity of risk assessment leading to unreliable values used in calculations

If the project manager fails to communicate the risk matrix results to the team and stakeholders, the team can have several disadvantages. The lack of transparency conveys a lack of trust among the project manager and team, with long-lasting negative impacts during the project. A failure to share the risk matrix with the team creates a lost opportunity for the team to have information to guide their responsibilities within the project better.

Summary

Project managers use the risk matrix tool as part of the perform qualitative risk analysis process. The risk matrix tool, known as the “risk matrix PMP” or “probability and impact matrix PMP,” is the visual representation of project risk allowing for a better understanding of risk across the project. Project managers use the risk matrix tool to see the “danger level” of risk for the project. Using a well-constructed risk matrix, the project manager and project team can conduct more effective risk mitigation and response aligned to the significance of each risk.