Risk Matrix

---

name: risk-matrix description: "Identify and prioritize risks by impact and controllability. Use for risk management, project planning, and strategic decision support."

---

Risk Matrix

Metadata

Name: risk-matrix

Description: Risk identification and prioritization framework

Triggers: risk matrix, risk assessment, risk analysis, risk prioritization

Instructions

You are a risk manager analyzing risks for $ARGUMENTS.

Identify, assess, and prioritize risks to inform mitigation strategy.

Framework

Risk Assessment Dimensions

Impact (Significance)

High: Major financial loss, strategic damage, regulatory issue

Medium: Moderate financial impact, operational disruption

Low: Minor impact, easily absorbed

Controllability

Manageable: Within our control

Mitigatable: Can reduce but not eliminate

Non-controllable: External, must accept

The 2×2 Risk Matrix

                        IMPACT
                    HIGH         MEDIUM        LOW
                  ┌───────────┬───────────┬───────────┐
           HIGH   │ CRITICAL  │  ACCEPT   │  ACCEPT   │
                  │  ⚠️⚠️⚠️   │    ✅     │    ✅     │
  CONTROLLABILITY │ Monitor & │  Manage   │  Monitor  │
           MEDIUM │  Mitigate │           │           │
                  ├───────────┼───────────┼───────────┤
           LOW    │ TRANSFER  │  MANAGE   │  IGNORE   │
                  │  🔸       │    ⚠️     │    ⚪     │
                  │ Insurance │ Conting.  │  Watch    │
                  └───────────┴───────────┴───────────┘

Risk Categories

| Category | Examples | |----------|----------| | Financial | Cost overrun, currency, credit | | Operational | Supply chain, technology, people | | Strategic | Competition, market shift, regulation | | Reputational | Brand damage, PR crisis | | Compliance | Regulatory, legal, ethical | | Environmental | Natural disaster, climate |

Output Format

## Risk Matrix: [Project/Initiative/Decision]
Scope
Subject: [What's being analyzed]
Context: [Background]
Time Horizon: [Planning period]
Risk Identification
| ID | Risk Category | Risk Description | Trigger Event |
|----|---------------|------------------|---------------|
| R1 | Financial | [Description] | [What would cause this] |
| R2 | Operational | [Description] | [What would cause this] |
| R3 | Strategic | [Description] | [What would cause this] |
| R4 | Compliance | [Description] | [What would cause this] |
| R5 | Reputational | [Description] | [What would cause this] |
| R6 | Environmental | [Description] | [What would cause this] |
Risk Assessment Matrix
| Risk | Impact | Controllability | Financial Impact | Probability | Priority |
|------|--------|-----------------|------------------|-------------|----------|
| R1 | High | Low | $X M | 30% | 🔴 Critical |
| R2 | High | Medium | $Y M | 20% | 🔴 Critical |
| R3 | Medium | High | $Z M | 40% | 🟡 Manage |
| R4 | Medium | Medium | $W M | 50% | 🟡 Manage |
| R5 | Low | Low | $V M | 10% | 🟢 Accept |
| R6 | Low | High | $U M | 60% | 🟢 Accept |
Visual Matrix

IMPACT HIGH MEDIUM LOW ┌─────────────┬─────────────┬─────────────┐ HIGH │ R1 🔴 │ R3 🟡 │ R5 🟢 │ │ [Name] │ [Name] │ [Name] │ CONTROLL-│ │ │ │ ABILITY │ R2 🔴 │ R4 🟡 │ R6 🟢 │ MEDIUM│ [Name] │ [Name] │ [Name] │ │ │ │ │ LOW │ [Empty] │ [Empty] │ [Empty] │ │ │ │ │ └─────────────┴─────────────┴─────────────┘

Legend: 🔴 Critical - Must address immediately 🟡 Manage - Active monitoring and mitigation 🟢 Accept - Monitor only

Risk Details & Mitigation
#### 🔴 Critical Risks
R1: [Risk Name]
Description: [What could happen]
Trigger: [What would cause it]
Impact if realized: $X M / [Other consequences]
Probability: X%
Current controls: [What's in place]
Mitigation strategy: [What to do]
Owner: [Who's responsible]
Residual risk: [Risk after mitigation]
Cost of mitigation: $Y
R2: [Risk Name]
[Same structure]
#### 🟡 Managed Risks
R3: [Risk Name]
Description: [What could happen]
Trigger: [What would cause it]
Impact if realized: $X M
Probability: X%
Monitoring plan: [How we'll track]
Contingency: [What we'll do if it happens]
Owner: [Who's responsible]
[Continue for all managed risks]
#### 🟢 Accepted Risks
R5: [Risk Name]
Description: [What could happen]
Impact if realized: $X M
Why accepted: [Rationale]
Monitoring: [Basic tracking]
[Continue for all accepted risks]
Risk Response Summary
| Risk | Response Type | Action | Owner | Status |
|------|---------------|--------|-------|--------|
| R1 | Mitigate | [Action] | [Name] | ⏳ In progress |
| R2 | Transfer | Insurance/Contract | [Name] | ⏳ In progress |
| R3 | Mitigate | [Action] | [Name] | ⏳ In progress |
| R4 | Accept | Monitor | [Name] | ✅ In place |
| R5 | Accept | Monitor | [Name] | ✅ In place |
| R6 | Accept | Monitor | [Name] | ✅ In place |
Response Types:
Mitigate: Reduce probability or impact
Transfer: Insurance, contracts, outsourcing
Accept: Acknowledge and monitor
Avoid: Change plan to eliminate risk
Risk Register
Total Risk Exposure: $X M (weighted by probability)
Critical Risks: 2 (require immediate action)
Managed Risks: 2 (active monitoring)
Accepted Risks: 2 (monitor only)
Risk Trend: Increasing / Stable / Decreasing
Risk Capacity: $Y M available to absorb
Headroom: $Z M
Early Warning Indicators
| Risk | Leading Indicator | Threshold | Current | Status |
|------|-------------------|-----------|---------|--------|
| R1 | [Metric] | [Value] | [Actual] | 🟢 OK |
| R2 | [Metric] | [Value] | [Actual] | 🟡 Watch |
| R3 | [Metric] | [Value] | [Actual] | 🟢 OK |
Next Steps
Immediate (This Week)
1. [Action for R1]
2. [Action for R2]
Short-term (This Month)
1. [Action for R3]
2. [Set up monitoring]
Ongoing
1. Monthly risk review
2. Quarterly reassessment
3. Update as conditions change

Tips

Focus on material risks - don't list everything

Be specific about triggers and impacts

Quantify financial impact where possible

One risk owner per risk

Distinguish between inherent and residual risk

Update regularly - risks change

The process matters as much as the matrix

Don't over-mitigate - some risk is acceptable

References

ISO 31000:2018 - Risk Management Guidelines

COSO Enterprise Risk Management Framework

Hubbard, Douglas. *The Failure of Risk Management*. 2009.

Focus on material risks - don't list everything

Be specific about triggers and impacts

Quantify financial impact where possible

One risk owner per risk

Distinguish between inherent and residual risk

Update regularly - risks change

The process matters as much as the matrix

Don't over-mitigate - some risk is acceptable