Find the initial risk ratings

Use a risk matrix to add together the impact and likelihood assessments to find each risk’s initial rating — also called an overall or a gross rating.

Find your initial risk rating

For each risk, use its:

Organisations often have a matrix, like the example in Table 1, for showing a risk’s rating. The risk rating will be the cell where the row and column meet up for a risk’s impact and likelihood.

Sometimes, organisations have different numbers assigned to each cell. Regardless, the most important information is the zone where the risk is located.

Table 1: Example of a risk matrix
Level of impact Likelihood: Almost never Likelihood: Possible but unlikely Likelihood: Possible Likelihood: Highly probable Likelihood: Almost certain
Severe

zone 3 (orange)

zone 3 (orange)

zone 4 (red)

zone 4 (red)

zone 4 (red)
Significant

zone 2 (yellow)

zone 3 (orange)

zone 3 (orange)

zone 3 (orange)

zone 4 (red)
Moderate

zone 2 (yellow)

zone 2 (yellow)

zone 2 (yellow)

zone 3 (orange)

zone 3 (orange)
Minor

zone 1 (green)

zone 2 (yellow)

zone 2 (yellow)

zone 2 (yellow)

zone 3 (orange)
Minimal

zone 1 (green)

zone 1 (green)

zone 2 (yellow)

zone 2 (yellow)

zone 2 (yellow)

Organising risks by importance

Organisations specify which risk ratings are of higher or lower importance — typically by sorting them into 4 levels of importance:

  • red — zone 4
  • orange — zone 3
  • yellow — zone 2
  • green — zone 1.

Knowing a risk’s level of importance allows you to report risks to the right level of reporting and risk ownership.

Evaluate the risks: Who can accept risks in each zone

Examples of initial risk ratings

Example — Risk scenario, initial risk rating: zone 2
  • Impact rating: ‘moderate’.
  • Likelihood rating: ‘almost never’.
Example — Risk scenario, initial risk rating: zone 3
  • Impact rating: ‘minor’.
  • Likelihood rating: ‘almost certain’.
Example — Risk scenario, initial risk rating: zone 4
  • Impact rating: ‘severe’.
  • Likelihood rating: ‘possible’.

Next steps — existing controls and final risk ratings

Now that you have the risk rating with no controls in place, find the:

Utility links and page information

Was this page helpful?
Thanks, do you want to tell us more?

Do not enter personal information. All fields are optional.

Last updated