Risk Matrix for Security Risk Assessment: How to Build One

What is a risk matrix?

A risk matrix, sometimes called a heat map, sets likelihood on one side and consequence on the other. Each cell carries a rating. A risk that is unlikely but would be severe might rate high. A risk that is likely but minor might rate medium.

AS ISO 31000:2018 asks organisations to analyse and evaluate risk against criteria they have set, but it does not prescribe a matrix or any other technique.¹ The matrix is one of the techniques described in the risk assessment techniques standard, AS/NZS IEC 31010:2020, where it appears as the consequence and likelihood matrix.² For security, Standards Australia’s handbook SA HB 167:2025, Managing security related risks, applies the same process to threats against people, information and assets.³

How do you build a 5 x 5 risk matrix?

Most security risk assessments in Australia use five levels of likelihood and five levels of consequence. The grid is the easy part. The work is in the scales.

1. Write the consequence scale first. Describe each level in terms the organisation uses: harm to people, loss of service, financial loss, legal or regulatory breach, and damage to reputation. A severe consequence for a small clinic is not the same as for a port.
2. Write the likelihood scale with a time frame. For example, almost certain might mean expected at least once a year, and rare might mean not expected in the next ten years. Without a time frame, two people will rate the same risk differently.
3. Set the rating bands. Decide which cells are low, medium, high and extreme. This reflects how much risk the organisation is willing to carry, so it should follow its risk appetite statement where one exists.
4. Say what each rating means. State who must be told, who can accept the risk, and how quickly it must be treated at each level.
5. Test it. Rate three or four known risks and check the results match common sense. Adjust the scales before using them widely.

The grid below is an example only. Each organisation should set its own bands.

How is a risk matrix used in a security risk assessment?

In a security risk assessment the matrix is applied after the threats, the assets and the existing controls have been examined. Likelihood is judged from the threat (who might act, with what intent and capability) and from how exposed the site or system is. Consequence is judged from what would be lost or harmed.

• Rate each risk as it stands today, with existing controls in place.
• Compare the rating with the organisation’s criteria to decide whether it needs treatment.
• Propose controls, then rate the risk again to show the expected residual risk.
• Record the reasoning for each rating, so that someone else could follow it later.

The steps before and after the matrix are set out in the security risk assessment process guide. Choosing controls is covered in the guide to risk mitigation.

What are the limits of a risk matrix?

A matrix is quick and easy to explain, which is why it is so widely used. It also has limits that are worth stating in any report.

• Bands are coarse. Two risks in the same cell can be very different in size.
• Rare but catastrophic events are easy to under-rate. A low likelihood can pull a severe risk into a comfortable colour. Consider these separately.
• Scores suggest precision that is not there. Multiplying a likelihood of 2 by a consequence of 5 gives a number, not a measurement.
• People rate differently. Without clear scales and a facilitated discussion, ratings reflect the person more than the risk.
• Colours take over. A red cell can drive spending when the criteria, not the colour, should decide.

How should matrix results be presented to a board?

A board does not fund a colour. It funds a decision. For each risk that rates above the organisation’s tolerance, a useful paper shows:

• what the rating means in plain consequence terms;
• the treatment options, costed and staged, so the board can see what the first step buys;
• the rating expected after each option;
• who would accept the risk that remains.

For Australian Government entities, the PSPF requires the accountable authority to determine the entity’s tolerance for security risks and record it in the security plan, so residual ratings should be compared with that tolerance.⁴

Common risk matrix mistakes

• Borrowing another organisation’s scales without changing them.
• Rating risks before the threat and the existing controls have been examined.
• Rating only once, so the benefit of treatment is never shown.
• Leaving out the reasoning behind a rating.
• Treating the rating as the answer, with no decision recorded.

How Agilient helps

Agilient builds risk criteria and matrices with clients as part of security risk assessments, and facilitates the rating workshops so that results are consistent and defensible. Recommendations are costed and independent of any product, because Agilient does not sell or install security equipment. The security risk management framework guide explains where the matrix fits in the wider process.