Calculator Input
Formula Used
Inherent Risk Score = Likelihood × Impact
Residual Risk Score = Residual Likelihood × Residual Impact
Risk Reduction = Inherent Score − Residual Score
Control Effectiveness = (Risk Reduction ÷ Inherent Score) × 100
Scoring bands used in this tool are simple and practical. Scores 1 to 4 are Low. Scores 5 to 9 are Moderate. Scores 10 to 16 are High. Scores 17 to 25 are Critical.
How to Use This Calculator
- Enter the risk title, category, and owner.
- Select a likelihood score from 1 to 5.
- Select an impact score from 1 to 5.
- Set the appetite threshold your team uses.
- Enter residual likelihood and residual impact after controls.
- Describe existing controls and add review notes.
- Click the calculate button to see the result above the form.
- Download the result as CSV or PDF if needed.
Example Data Table
| Risk | Likelihood | Impact | Inherent Score | Residual Likelihood | Residual Impact | Residual Score | Residual Level |
|---|---|---|---|---|---|---|---|
| Supplier outage | 4 | 5 | 20 | 3 | 4 | 12 | High |
| Incorrect payroll file | 3 | 4 | 12 | 2 | 3 | 6 | Moderate |
| Phishing incident | 5 | 4 | 20 | 3 | 3 | 9 | Moderate |
| Missed compliance filing | 2 | 5 | 10 | 1 | 4 | 4 | Low |
Likelihood Impact Risk Matrix in Risk Management
Why this matrix matters
A likelihood impact risk matrix helps teams score threats with structure. It turns opinions into repeatable ratings. That makes risk reviews faster. It also improves reporting, prioritization, and control planning. Many teams use this method in operational, financial, compliance, cyber, and project risk work.
How the calculator supports decisions
This calculator measures inherent risk first. Inherent risk is the raw exposure before stronger treatment actions are considered. The tool then measures residual risk. Residual risk shows what remains after controls, checks, approvals, backups, training, or monitoring steps are applied. That comparison helps managers see whether controls are actually reducing exposure.
Using likelihood and impact scores well
Likelihood estimates how often a risk may happen. Impact estimates how serious the outcome could be. Multiplying both values creates a consistent risk score. Higher values usually need faster action. Lower values may be accepted and reviewed later. A clear scale keeps scoring consistent across departments and projects.
Inherent versus residual exposure
Strong risk assessment does not stop at one score. It compares the before and after position. That is why the residual section matters. If the residual score still sits above appetite, the risk needs more treatment. If it falls within appetite, the risk may be accepted with monitoring. This supports better governance and stronger audit evidence.
Where this tool fits in a risk register
You can use the output in a risk register, action plan, or management report. The result shows the score, level, priority, and recommended response. The export options help teams share a consistent summary. This makes board updates, internal reviews, and control meetings easier to document.
Practical value for daily risk reviews
A good risk matrix should stay simple. It should also stay useful. This calculator does both. It supports quick scoring, control review, residual analysis, and treatment planning in one place. That helps teams focus on the most important risks first and track whether controls are working over time.
FAQs
1. What does a likelihood impact risk matrix measure?
It measures how probable a risk is and how serious the outcome could be. The combined score helps rank risks for treatment, monitoring, escalation, or acceptance.
2. What is the difference between inherent and residual risk?
Inherent risk is the exposure before stronger controls are considered. Residual risk is the exposure that remains after controls, safeguards, reviews, or mitigation steps are in place.
3. Why multiply likelihood by impact?
Multiplication creates a simple scoring model. It increases the score only when both probability and consequence rise. That makes prioritization easier during risk reviews.
4. What is a good risk appetite threshold?
The right threshold depends on your organization, industry, and objectives. Many teams set a cutoff that separates acceptable exposure from risks needing action or escalation.
5. Can this calculator be used for project risks?
Yes. It works for project, operational, vendor, cyber, compliance, and financial risks. Any situation with probability and consequence can fit this matrix approach.
6. How often should residual risk be reviewed?
Review it on a set schedule and after major changes. Good triggers include incidents, control failures, audits, process updates, supplier changes, and new regulations.
7. What does control effectiveness mean here?
It shows how much the score dropped from inherent to residual risk. A larger percentage means current controls reduce more exposure in this scoring model.
8. Is a low score always safe to accept?
No. A low score may still matter if the risk is regulated, highly visible, or strategically sensitive. Context, obligations, and management judgment still matter.