Risk matrix for business decisions: how to build and read one
The essentials in 30 seconds
- A risk matrix plots each risk by likelihood and impact on a 5 by 5 grid and colours the grid in zones.
- In the market entry example, 3 risks land in red and 3 in amber.
- Three mitigations move the price war from 16 to 8, and the currency swing and licence delay from 12 to 8.
- The matrix is a screening picture, and written definitions stay beside it.
- The EQOS Asia Audit pillar lists the 3 priority risks (EQOS Asia method page, as of October 2026).
A risk matrix places each risk on a grid, with likelihood on one axis and impact on the other, and colours the grid in zones that call for different responses. It shows in one picture where attention should go before a decision is taken. This page explains how to build and read one, with illustrative figures, as of October 2026. It is the visual companion of the risk scoring model.
Compare the EQOS Asia offers and request a 30-minute pre-diagnostic.
What is a risk matrix and what does it show about a decision?
A risk matrix is a grid, most often 5 by 5, that positions each identified risk by its likelihood and its impact. The position places the risk in a zone, usually green, amber, or red, and each zone has an agreed response. One look at the grid shows how many risks sit in the top right corner and which of them deserve the first conversation.
For a business decision, the matrix answers a practical question: which risks could change the choice, and which can be managed after it? A risk in the red zone belongs in the decision meeting. A risk in the green zone belongs in a monitoring list. The picture helps a board that has little time to read a long register.
How do you define the axes of a risk matrix for business decisions?
Give each of the 5 levels on both axes a plain definition. For likelihood, 1 means rare, 3 means possible within the horizon, and 5 means almost certain. For impact, tie each level to a money figure or a delay that the organisation recognises, such as 1 for under 1 percent of annual profit and 5 for a threat to the project itself.
Write the definitions on the sheet and keep them fixed for all risks. Two people who read the same words should place a risk in the same row. When the definitions are vague, the matrix records the mood of the meeting and not the exposure of the decision.
How do you set the colour zones of a risk matrix?
Zones come from the product of likelihood and impact, with thresholds fixed in advance. In this example a score from 1 to 5 is green, a score from 6 to 11 is amber, and a score of 12 or more is red. Each colour carries a rule: monitor, mitigate with an owner, or escalate to the decision maker before the choice.
Look at the corners before accepting the thresholds. A risk with likelihood 1 and impact 5 scores 5 and lands in green, yet a single such event could end the project. Many teams turn the top row of impact red whatever the likelihood, so that catastrophic outcomes always reach the decision meeting.
How do you plot the risks of a business decision on the matrix?
Take a market entry, all scores illustrative. Six risks are rated for likelihood and impact. A price war scores 4 and 4, which makes 16 and lands in red. A licence delay scores 3 and 4, which makes 12 and lands in red. A currency swing scores 4 and 3, which makes 12 and also lands in red.
A partner exit scores 2 and 5, which makes 10 and lands in amber. A cyber incident scores 2 and 4, which makes 8 and lands in amber. A key hire shortfall scores 3 and 2, which makes 6 and lands in amber. No risk sits in green, and three sit in red, so the decision needs a mitigation plan before approval.
How do you read a risk matrix before taking a decision?
Read in three passes. First count the reds and name an owner for each. Second, look for clusters, because several risks in the same corner often share a cause. In the example, the price war and the currency swing both hit margin, and a combined shock would be worse than either alone.
Third, ask which risks the decision itself can change. A choice to enter through a partner moves the licence delay from the company to the partner. A choice to price in local currency removes part of the currency swing. The matrix thus feeds the decision directly, since each option shifts the position of some risks.
How does mitigation move a risk across the matrix?
A mitigation lowers either the likelihood or the impact, and the risk moves left or down. Long-term contracts reduce the chance of a price war from 4 to 2, which moves its score from 16 to 8. A currency hedge reduces the impact from 3 to 2, which moves the score from 12 to 8. Early filing moves the licence delay from 3 to 2, and its score from 12 to 8.
After the three mitigations, all red risks sit in amber and the residual picture has no red cell. Show both versions side by side, before and after, and attach a cost and an owner to each move. The board then sees what the plan buys and what it costs.
What are the limits of a risk matrix, and where does a decision engine help?
A risk matrix compresses information. Ordinal levels hide the size of a difference, two very different risks can share a cell, and the colours imply a precision that the ratings lack. Treat the matrix as a screening picture and keep the written definitions and the evidence beside it.
The EQOS Asia decision engine looks at the situation as a whole: its Audit pillar scores 9 structural dimensions, returns a φ(S) score between 0 and 1, and lists the 3 priority risks (EQOS Asia method page, as of October 2026). A reader can try a first score in the simulator and compare it with the matrix.
See also in this guide
Frequently asked questions
What is a risk matrix?
A risk matrix is a grid that places each risk by its likelihood and its impact, usually on 5 levels each. The cell falls in a colour zone, and each zone has an agreed response: monitor, mitigate with an owner, or escalate to the decision maker.
How do you build a risk matrix?
Define the 5 levels of likelihood and of impact in words, set the zone thresholds, list the risks, and rate each one with a line of evidence. Plot the scores on the grid and name an owner for every red risk. Review the grid when the facts change.
What is the difference between a risk matrix and a risk score?
A risk score is the number from multiplying likelihood by impact. A risk matrix is the grid that displays those scores and groups them in zones. The score ranks the risks, and the matrix shows the shape of the whole exposure in one picture.
Can the EQOS Asia pre-diagnostic complement a risk matrix?
Yes. The free 30-minute pre-diagnostic applies the EQOS Asia equation to your decision across 9 dimensions and names the 3 priority risks. It runs by video in Singapore time (SGT) under NDA (EQOS Asia contact page, as of October 2026).
Test your knowledge
1. How many levels does the standard risk matrix in this guide use on each axis?
- 3
- 5
- 9
Show the answer
5.
2. What is the score of the price war in the example?
- 12
- 8
- 16
Show the answer
16.
3. Which zone does a score of 10 fall in?
- Amber
- Red
- Green
Show the answer
Amber.
4. What does a mitigation do to a risk on the matrix?
- Moves it left or down
- Removes the matrix
- Moves it to the top right
Show the answer
Moves it left or down.
5. Why turn the top row of impact red?
- To add colour
- So catastrophic outcomes reach the meeting
- To lower scores
Show the answer
So catastrophic outcomes reach the meeting.
About the author
Stéphane Jambu
President, EQOS Forecast Asia
Stéphane Jambu leads EQOS Forecast Asia and works as a consultant in e-commerce, search visibility, and AI. LinkedIn profile
Sources: EQOS Asia method page (eqos-asia.com/method.html), simulator page (eqos-asia.com/simulator.html), and contact page (eqos-asia.com/contact.html), consulted on 22 October 2026. Page updated on 22 October 2026.