What is a probability–impact matrix and how is it used in risk assessment?

What is a probability–impact matrix and how is it used in risk assessment?

• A. A grid mapping likelihood against impact to prioritize risks and decide treatment priority.
• B. A chart of probability of revenue vs cost.
• C. A matrix for performance appraisal.
• D. A schedule of project milestones.

Answer: (A)

A probability–impact matrix is a grid used in risk assessment to place each identified risk based on two dimensions: how likely it is to occur and how severe the consequence would be. By plotting risks on this grid, you get a visual, two‑dimensional view that highlights where risks are most pressing. The common upshot is a color‑coded map (for example, green to red) showing low to extreme risk levels, which makes it easy to see which risks warrant attention. This approach helps decide treatment priorities because higher‑risk cells—where high probability meets high impact—signal where action is most needed. It guides decisions about what to accept, what to avoid, what to reduce with controls, or what to transfer. The matrix also supports communicating risk to stakeholders and checking alignment with the organization’s risk appetite, since risks that sit in the threshold zones can be flagged as tolerable or intolerable. The matrix is typically qualitative or semi‑quantitative and can be 3×3 or 5×5, providing a flexible, intuitive method that complements more detailed quantitative analyses. It’s a standard tool in risk management frameworks like ISO 31000. Other options describe different kinds of charts or tools that aren’t about assessing and prioritizing risk by likelihood and impact, such as revenue–cost charts, performance appraisal matrices, or project schedules.

A probability–impact matrix is a grid used in risk assessment to place each identified risk based on two dimensions: how likely it is to occur and how severe the consequence would be. By plotting risks on this grid, you get a visual, two‑dimensional view that highlights where risks are most pressing. The common upshot is a color‑coded map (for example, green to red) showing low to extreme risk levels, which makes it easy to see which risks warrant attention.

This approach helps decide treatment priorities because higher‑risk cells—where high probability meets high impact—signal where action is most needed. It guides decisions about what to accept, what to avoid, what to reduce with controls, or what to transfer. The matrix also supports communicating risk to stakeholders and checking alignment with the organization’s risk appetite, since risks that sit in the threshold zones can be flagged as tolerable or intolerable.

The matrix is typically qualitative or semi‑quantitative and can be 3×3 or 5×5, providing a flexible, intuitive method that complements more detailed quantitative analyses. It’s a standard tool in risk management frameworks like ISO 31000.

Other options describe different kinds of charts or tools that aren’t about assessing and prioritizing risk by likelihood and impact, such as revenue–cost charts, performance appraisal matrices, or project schedules.