The composite risk index and the 5×5 risk matrix

The composite risk index and 5×5 matrix provide a compact way to compare risks by combining their likelihood and consequence.

When to use it

• Use the index to prioritise risks in strategy, projects, operations, safety, healthcare and governance.
• Apply the same structure to financial, information-security, reputational and safeguarding concerns, not only obvious physical hazards.
• For each material risk, select one of the 4Ts: terminate, transfer, treat or tolerate.

Origins

The 5×5 likelihood–consequence matrix is a modern form of risk-assessment methods used across twentieth-century engineering, military safety and project management. No single inventor owns this version; organisations and standards converged on ordinal categories that are easy to display. Multiplying ratings produces a ranking aid, not a measured probability or expected loss, because labels such as ‘unlikely’ and ‘likely’ are not interval-scale quantities.

What it is

Risk tools can become visually dense and focus only on threats rather than opportunities. The matrix’s advantage is rapid communication: it makes the organisation’s current judgements visible and gives leaders a common basis for discussing priorities. Its simplicity must be balanced with context about uncertainty, velocity, control effectiveness and exposure.

How to use it

Assemble the principal market, competitive, strategic and operational risks identified during strategy development. Define the scoring criteria before rating anything.

For likelihood, move from rare, through unlikely, possible and probable, to almost certain. For impact, move from negligible, through minor, moderate and major, to severe. Assign each category a grade and combine the two grades to form the composite index.

A simple classification is:

1 to 8: Small risks

9 to 16: Medium risks

20 or 25: Big risks

A risk scored as likely (4) with severe impact (5), or almost certain (5) with major impact (4), demands urgent attention. An external market risk that the company cannot control may make the opportunity unacceptable. A controllable internal risk requires credible prevention, mitigation and contingency measures.

Some high-reliability settings expand the ‘big’ region to include scores of 20 and 25, 15 and 16, and even 10 when a rare event has severe consequences. This reflects risk appetite, not a universal property of the arithmetic.

The 535 risk matrix: an example

5 Key

4 Big risk

3 Medium risk

Small risk

1 2 3 4 5

Likelihood

Choose a response:

• Terminate: avoid the exposure where the activity is unnecessary or the risk exceeds appetite.
• Transfer: use insurance, contract or partnership where another party can genuinely bear or manage part of the consequence.
• Treat: reduce likelihood, impact or both through controls and contingencies.
• Tolerate: accept a small or uneconomic-to-reduce exposure, while monitoring it.

Document the evidence, owner, existing controls, target rating and review date. Reassess after treatment rather than assuming an action automatically changed the residual risk.

Top practical tip

Define likelihood and impact consistently, rate the exposure with evidence, and record both the current and residual risk after treatment.

Top pitfall

Do not turn the register into page after page of conceivable events or mistake an ordinal product for a precise measure of risk.

Further reading

• International Organization for Standardization (twenty eighteen). Risk Management—Guidelines. ISO.
• Cox, L.A. (two thousand and eight). “What’s Wrong with Risk Matrices?” Risk Analysis.