Risk Priority Matrix
Assess and prioritize project risks by impact and probability
What is Risk Priority Matrix?
The Risk Priority Matrix is a free project management tool that helps you assess and rank project risks by combining how likely they are with how damaging they would be. You choose a matrix size (3×3, 4×4, or 5×5), list each risk, rate its probability and its impact on the chosen scale, and add an optional mitigation note. The tool multiplies probability and impact into a risk score, then plots every risk on a colour-coded matrix and sorts them into four severity bands — Low, Medium, High, and Critical — with a running count of how many risks fall in each band. Starter templates for a software project, an event, or operations let you populate a register in one click, all in your browser with no signup.
How to use Risk Priority Matrix?
Building a prioritised risk register takes just a few minutes:
- 1 Pick a matrix size that suits your team — 3×3 for quick triage, 4×4 or 5×5 for finer granularity — or load a starter template (software project, event, or operations) to begin from a worked example.
-
2
Define your risks by adding each one with a clear, specific description and an optional mitigation note. Strong descriptions such as
Key supplier may miss the delivery deadlineare far more actionable than vague labels. - 3 Rate every risk on two scales: probability from rare to certain and impact from minimal to severe, using the range set by your matrix size. The tool multiplies these to produce a combined risk score.
- 4 Review the matrix view and the severity summary, where each risk is plotted, colour-coded, and counted across the Low, Medium, High, and Critical bands so the worst threats stand out instantly.
- 5 Prioritise action on the highest-scoring risks first, record a mitigation plan for each, and revisit the register weekly so scores stay current as the project evolves.
Why use this tool?
Not every risk deserves the same attention, and treating them equally wastes effort on minor issues while serious threats slip through. A risk priority matrix forces a deliberate, comparable assessment so that a high-probability, high-impact risk visibly outranks a rare, minor one. A configurable 3×3, 4×4, or 5×5 grid lets you match the level of detail to the project, while the four severity bands and per-band counts turn a long list into an instant visual decision aid that the whole team and stakeholders can understand. Capturing a mitigation note beside each risk keeps the response plan attached to the threat it addresses. Because the tool runs locally in your browser, your risk register never leaves your device, making it safe for confidential projects. Used consistently, it focuses mitigation budgets where they matter most and creates a documented audit trail of how risks were judged and managed.
Examples
On a 5×5 matrix a single-source supplier failing to deliver on time at probability 4 and impact 5 produces a score of 20, landing in the Critical band for immediate mitigation.
A small UI inconsistency rated probability 2 and impact 1 scores just 2, landing in the Low band where it can be logged and monitored without urgent action.
Scope creep at score 9 and a staffing gap at score 12 both look moderate, but the matrix and severity summary show the staffing gap sits higher and should be addressed first.
Frequently Asked Questions
How is the risk score calculated?
The score is simply probability multiplied by impact. On a 5×5 matrix each is rated from 1 to 5, giving a value between 1 and 25; smaller matrices use a proportionally smaller range. Higher scores indicate risks that are both more likely and more damaging.
What do the severity bands mean?
Each risk is sorted into Low, Medium, High, or Critical based on its score as a proportion of the maximum possible score. Critical and High risks need active mitigation, Medium risks need monitoring, and Low risks can usually be accepted. The summary counts how many risks fall in each band.
Which matrix size should I choose?
A 3×3 matrix is quick for lightweight triage, while 4×4 and 5×5 give finer distinctions for larger or higher-stakes projects. You can switch size at any time, and existing risks are automatically clamped and rescored to the new range.
How often should I update the register?
Review it at least weekly. Probabilities and impacts shift as the project progresses, new risks emerge, and mitigations take effect, so regular updates keep priorities accurate.
Is my risk data kept private?
Yes. The entire matrix is calculated in your browser, so risk descriptions, mitigation notes, and scores are never uploaded to a server, which makes the tool suitable even for sensitive projects.
Related Tools
Explore more free tools you might find useful