# Risk matrix template: free guide to score project risks > Download a risk matrix template and learn to score likelihood x severity, calculate impact (1–25), and prioritize risks using 3x3, 4x4, or 5x5 matrices. Source: https://asana.com/es/resources/risk-matrix-template ## Risk Matrix Template: Free Guide to Score Project Risks #### Summary A risk matrix analyzes project risks based on likelihood and severity. Once you map your risks, you can calculate the overall impact and prioritize them accordingly. Learn how to create a risk matrix template and use it to develop a comprehensive risk management plan.Risks are a part of any project, and there's no surefire way to know which ones will occur and when. Sometimes, you'll get through an entire project without experiencing a single hiccup. Other times, you'll feel like all the odds are against you. Without a crystal ball, the only way to prevent project risks is to plan for them. A risk matrix assigns each event a score from 1 to 25, categorizing it as high, medium, or low impact. In this article, we'll compare different matrix sizes, explore the benefits, and walk you through how to create and use a risk matrix template. ## What is a risk matrix in project management? A risk matrix is a visual tool that helps project managers assess and prioritize risks based on two factors: likelihood of occurrence and severity of impact. By plotting risks on a grid, teams can quickly identify which threats need immediate attention and allocate resources accordingly. ### Types of risks As part of the process, you'll need to brainstorm a list of [project risks](https://asana.com/resources/project-risks) to chart in your risk matrix. The risks you may face will likely fall into these categories: - **Strategic risk**: Strategic risks involve performance or decision errors, such as choosing the wrong vendor or software for a project. - **Operational risk**: Operational risks include process errors or procedural mistakes, such as poor planning or a lack of communication among teams. - **Financial risk**: Financial risk can involve various events that lead to a loss of company profits, including market changes, lawsuits, or competition. - **Technical risk:** Technical risk may include any issue related to the company's technology, such as a security breach, power outage, loss of internet, or property damage. - **External risk:** External risks are out of your control, like floods, fires, natural disasters, or pandemics. There are other risk categories to consider depending on your work industry. For example, if you have government clients, then you also want to brainstorm legal risks. If your company sells a physical product, you may need to consider manufacturing risks. ## Types of risk matrices: 3x3, 4x4, and 5x5 A risk matrix can be adapted to fit the complexity of your project. While a 5x5 grid is common, you might choose a simpler or more detailed version depending on your needs. The goal is to find the right balance of detail without making the process too complicated. Here's how the three most common matrix sizes compare: Matrix type Levels Best for **3x3** 3 likelihood x 3 severity (Low, Medium, High) Small projects or teams new to risk assessment **4x4** 4 likelihood x 4 severity Moderately complex projects needing more distinction **5x5** 5 likelihood x 5 severity (Very Unlikely to Very Likely; Negligible to Catastrophic) Large, complex projects requiring granular analysis The 5x5 matrix is the most widely used format because it provides enough detail to make meaningful distinctions without overwhelming your team. ## Benefits of using a risk matrix Using a risk matrix helps your team move from reacting to problems to planning for them. It's a simple tool that offers powerful benefits for any project. - **Prioritize risks effectively.** A risk matrix gives you a clear, visual way to distinguish between high-priority threats that need immediate attention and low-priority issues that can be monitored. - **Improve decision-making.** With a clear understanding of potential risks, you can make more informed decisions about resource allocation, project timelines, and [strategic planning](/resources/strategic-planning). - **Enhance team communication.** The matrix serves as a single source of truth for project risks, making it easier to communicate potential challenges and response plans to stakeholders and team members. - **Support planning.** By identifying risks early in the planning process, you can develop [mitigation strategies](/resources/risk-mitigation) in advance rather than scrambling to find a solution when a problem occurs. ## How to create a risk matrix template Start by defining your severity scale, which measures how severe the consequences of each risk would be. In a 5x5 matrix, there are five levels: - **Negligible (1):** The risk will have little consequence if it occurs. - **Minor (2):** The consequences of the risk will be easy to manage. - **Moderate (3):** The consequences of the risk will take time to mitigate. - **Major (4):** The consequences of this risk will be significant and may cause long-term damage. - **Catastrophic (5):** The consequences of this risk will be detrimental and may be hard to recover from. Next, define your scale of likelihood, which measures the probability of each risk occurring: - **Very likely (5):** You can be pretty sure this risk will occur at some point in time. - **Probable (4):** There's a good chance this risk will occur. - **Possible (3):** This risk could happen, but it might not. This risk has split odds. - **Not likely (2):** There's a good chance this risk won't occur. - **Very unlikely (1):** It's a long shot that this risk will occur. When you place a risk in your matrix based on its likelihood and severity, you'll determine its level of impact. The risk impact is both color-coded from green to red and rated on a 1-25 scale. - **Low (1-6):** Low-risk events likely won't happen, and if they do, they won't cause significant consequences for your project or company. You can label these as low priority in your [risk management plan](/resources/project-risk-management-process). - **Medium (7-12):** Medium-risk events are a nuisance and can cause project hiccups, but if you take action during [project planning](/resources/project-management-plan) to prevent and mitigate these risks, you'll set yourself up for project success. You shouldn't ignore these risks, but they also don't need to be a top priority. - **High (13-25):** High-risk events can derail your project if you don't keep them top of mind during project planning. Because these risks are likely to happen and have serious consequences, they are most important in your risk management plan. You don't have to stick to the labels above for your risk matrix template if they don't feel right for your company or project. You can customize the size and terminology of your matrix to your needs. ## How to use a risk matrix Once you've created a risk matrix, you can use it as a comprehensive analysis tool. The best part about a risk matrix template is that you don't need to change it for every project. Once you have one, you can reuse it and share it with others. - [建立風險管理計劃範本](/templates/risk-management-plan) ### 1. Identify project risks You'll need a list of potential risks, often documented in a [risk register](/templates/risk-register), to make use of your risk matrix. In this step, you'll identify the risks that may affect the specific project you're working on. To identify relevant risks for your project, you'll need to understand your [project scope](/resources/project-scope) and objectives. This includes the project's: - [Timeline](/resources/create-project-management-timeline-template) - [Budget](/resources/project-budget) - [Resources](/resources/resource-management-plan) - [Constraints](/resources/project-constraints) Using your project scope as a guide, identify [common project risks](/resources/project-risks) that might affect your work. If you're not sure where to start, try [brainstorming techniques](/resources/brainstorming-techniques) like mind mapping or starbursting to list as many risks as you can under each risk type. ### 2. Determine severity of risks When you created your risk matrix, you defined the criteria for your risk severity and likelihood. Now that you have a list of project risks, categorize them using the matrix criteria. Start with the scale of severity and go through each risk you've listed. Consider the following questions: - What is the most negative outcome that could come from this risk? - What are the worst damages that could occur from this risk? - How hard will it be to recover from this risk? - Which of the five severity levels most closely matches this risk? You may not always have the perspective you need to know how severe the consequences of a risk are. In that case, work with other [project stakeholders](/resources/project-stakeholder) to determine the potential risk impact. ### 3. Identify likelihood of risks Once you've defined the severity of each risk, you've completed half of the risk analysis equation. Next, identify the likelihood of each risk. To do this, consider the following questions: - Has this risk occurred before and, if so, how often? - Are there risks similar to this one that have occurred? - Can this risk occur, and if so, how likely is it to occur? [Team collaboration](/resources/collaboration-in-the-workplace) is also crucial at this step because you may not have a clear understanding of similar risks that have occurred in past projects. Make sure to reference past projects and analyze the probability of each risk with your team in order to create a more accurate mitigation plan. - [閱讀：如何從專案管理中汲取經驗](/resources/lessons-learned) ### 4. Calculate risk impact The last part of your risk analysis equation is to calculate risk impact. The equation you'll use is: **Likelihood x severity = risk impact** Place each risk in your matrix based on its likelihood and severity, then multiply the numbers in the row and column where it lands to find the level of risk impact. For example, if you think the risk of a data breach is of major severity (4) and probable likelihood (4), you'd multiply four by four to get a risk impact of 16. This is considered a high-risk impact. ### 5. Prioritize risks and take action You should now have a risk impact level on a scale of 1-25 for each risk you've identified. With these number values, it's easier to determine which risks are of top priority. When you have risks with the same risk impact score, it will be up to you and your team to determine which risk to prioritize. Your [risk response plan](/resources/project-risk-management-process) should include steps to prevent risk and ways to mitigate risk if unfortunate events occur. Because so much goes into project planning, the best strategy when tackling risks may be to divide and conquer. - [閱讀：如何建立能推動結果的行動計劃](/resources/action-plan) ## Risk assessment matrix template The size of your risk matrix determines how closely you can analyze risks. A larger matrix offers more room on the impact spectrum, while a smaller one keeps ratings simpler. At a minimum, your matrix should be 3x3. A 5x5 risk matrix is ideal for most projects. It creates a larger color spectrum to visualize each risk as high, medium, or low. The example below shows a 5x5 risk matrix template: You can download a free risk matrix template using the link below. Use this template to chart your project risks and determine their overall impact. ## Pair your risk matrix template with a work management tool You can reuse the same risk matrix template across multiple projects. However, the risks you face will evolve as technology, your environment, and your workplace change. Reevaluate your risks regularly to keep your assessments relevant. When you pair your risk matrix template with [work management software](/uses/work-management), you can use past data to inform current processes. [Asana](/product) helps you share the results of your risk matrix with stakeholders so you can collaborate on a risk management plan. [Get started](/create-account) and turn your risk assessment into a clear action plan. ## Frequently asked questions about risk matrices #### What is a 5x5 risk matrix? A 5x5 risk matrix is a common risk analysis tool that uses five levels to measure the likelihood of a risk occurring and five levels to measure its potential severity or impact. By plotting risks on this grid, teams can calculate a risk score to help prioritize which issues to address first. #### What's the difference between a 3x3 and 5x5 risk matrix? A 3x3 matrix uses three categories (low, medium, high) and is best for quick assessments, while a 5x5 matrix offers five categories for more precise analysis on complex projects. #### How often should I update my risk matrix? Review and update your risk matrix at key project milestones or whenever new information changes the likelihood or impact of a risk. #### What are risk response strategies? The four common risk response strategies are: - **Avoid:** Change the plan to eliminate the risk - **Mitigate:** Take steps to reduce the likelihood or impact - **Transfer:** Shift the risk to a third party, like through insurance - **Accept:** Acknowledge the risk and proceed, typically for low-priority items - [專案管理](/resources/project-management) - [制定應變計劃以預防業務風險的 8 個步驟](/zh-tw/resources/contingency-plan) 商業策略 專案規劃 #### 作者 沒有人希望 A 計劃失效，但準備一份強大的 B 計劃是應對任何情況發生的最佳方式。有了可靠的後援計劃，您就可以有效應對非預期事件，並且盡快讓事情重回正軌。應變計劃是一種主動策略，能夠協助您處理事態惡化並確保業務持續進行。在本文中，深入瞭解如何針對非預期事件制定應變計劃，並且制定恢復策略，以確保您的業務維持健康狀態。什麼是業務應變計劃？業務應變計劃是一種策略 ... - [以 10 個步驟為您的專案啟動會議提供強大動力](/zh-tw/resources/project-kickoff-meeting) 專案規劃 #### 作者 雖然您已付出很多努力讓您的專案順利啟動，然而很多時候，甚至在開始執行專案之前，就已感覺好像偏離了進度。這是因為每位專案團隊成員和專案關係人都會將不同的知識、期望值和優先事項帶到專案中。如果在工作開始之前您並未讓大家有機會達成一致，那麼無論您如何努力修正，專案中其餘的部分都會舉步維艱。好在有一個更好的方法：專案啟動會議。啟動會議是讓團隊在開始工作前維持資訊同 ... - [何謂關係人分析，它為什麼很重要？](/zh-tw/resources/project-stakeholder) 專案管理 專案規劃 #### 作者 將您的專案當成奧斯卡提名電影。您得獎了，必須上台發表重要演說。您會感謝誰？就專案管理而言，這些人就是您的專案關係人——對於您專案有重要的關係，以及用某些方式協助您達成的人員。專案關係人可能是執行工作的人員、核准工作的人，或是您替他執行工作的對象，各有不同，但他們全都很重要。您可能難以相信，但找出專案關係人可能比準備奧斯卡受獎演說還要困難。因此專案關係人分析 ... - [艾森豪矩陣：如何安排待辦清單的優先順序](/zh-tw/resources/eisenhower-matrix) 領導 專案規劃 生產力 #### 作者 製作待辦清單是把工作完成的第一步，但若沒有足夠的時間在一天內完成所有工作，那要如何判斷要優先解決什麼問題？藉由有效安排優先順序，您就能提高生產力並確保最急迫的任務獲得立即處理。艾森豪矩陣是任務管理工具，可協助您分辨任務的輕重緩急，從而建立有效率的工作流程。本文說明如何設立艾森豪矩陣，並提供安排任務優先順序的提示。什麼是艾森豪矩陣？艾森豪矩陣是一種時間管理與 ... - [Risk matrix template: How to assess risk for project success](/zh-tw/resources/risk-matrix-template) 專案規劃 專案管理 專案管理 - [內容撰稿人](/author/team-asana) Risks are a part of any project, and there's no surefire way to know which ones will occur and when. Sometimes, you'll get through an entire project without experiencing a single ...