Risk matrix
A risk register and its heat map, scored rather than coloured by hand. Rate each risk on likelihood and impact (1–5 or named levels, 2–7 levels per axis), list its controls, residual and target positions, owner and actions, and the engine computes L×I scores and band ratings. It draws the matrix with risk ids in their cells and arrows from inherent to residual. It sorts the register, totals exposure and its reduction, and flags risks above appetite. Bands are configurable (thresholds, named ranges or a cell-by-cell matrix such as the ICAO tolerability matrix). The validator reports a residual worse than the inherent rating, a reduction no control explains, a risk with no owner, and a band that leaves a score unrated.
In the same space
Most users come to Risk matrix from Excel risk registers, Active Risk Manager heat maps, PowerPoint 5×5 matrices or Visio risk matrix templates. flowss runs this engine in the browser — no install, shareable via URL, exportable to PNG / SVG / PDF / source.
Syntax at a glance
appetite: Medium
risk R1 "Supplier insolvency" 3x4 -> 2x4 owner: Procurement
control "Credit monitoring"
risk R2 "Ransomware outage" 4x5 -> 2x4 owner: CISO
control "Immutable backups"
action "Segment the OT network"Paste this in the Studio code pane to see Risk matrix render live. The full grammar is at the upstream-docs link above.
Sample templates
All 12 →Eight principal risks for a fictional manufacturer on a 5×5 matrix with £-banded impacts: current controls cut total exposure Σ(L×I) from 99 to 55 (−44%) and move six risks down a band, while customer concentration, engineer retention, ransomware and a single-source alloy stay High — above the Medium appetite, each with a dated treatment action. Illustrative register.
An ISO/IEC 27005 register for a fictional payroll SaaS covering nine threat scenarios, from ransomware in the build pipeline to supplier-payment fraud: controls cut exposure from 114 to 53 (−54%) and take all four Critical risks out of the top band, while the edge VPN, the build pipeline and the open-source supply chain stay High and above appetite, each with a treatment. Illustrative register.
A principal contractor's register for a fictional 18-storey residential tower, with impacts banded by cost and programme: controls bring exposure from 89 to 52 (−42%), and the two risks left above the Medium appetite are a delayed Building Safety Regulator Gateway 2 approval (High 12) and façade subcontractor insolvency (High 8), both with treatment actions. Illustrative register.
An ICH E6(R3) risk-based quality management assessment for a fictional 2,400-participant phase III trial on a 3×3 matrix: controls cut exposure from 50 to 25 (−50%), take seven of eight critical-to-quality risks down a band, and leave only slow recruitment rated High — above appetite, with 20 extra sites as the treatment. Illustrative register.
A patient safety register for a fictional elderly-care ward on the familiar NHS 5×5 consequence × likelihood matrix with Low, Moderate, High and Extreme bands: controls reduce exposure from 92 to 56 (−39%), and deterioration (10), falls (9), night staffing (9) and insulin errors (8) remain High, above the Moderate appetite, each with an improvement action. Illustrative register.
A hazard log for a fictional ATR 72 operator rated on the ICAO Doc 9859 tolerability matrix — cell by cell, not by L×I, with 4B-style risk indices: mitigations bring the two Intolerable hazards, an unstable approach (4B) and wing contamination (3A), down to Tolerable, leaving all eight hazards within the Tolerable appetite. Illustrative register.
riskmatrix · ← Browse all engines · Quick-start guide