12 templates
Risk matrix templates
A risk register and its heat map, scored rather than coloured by hand. Rate each risk on likelihood and impact (1–5 or named levels, 2–7 levels per axis), list its controls, residual and target positions, owner and actions, and the engine computes L×I scores and band ratings. It draws the matrix with risk ids in their cells and arrows from inherent to residual. It sorts the register, totals exposure and its reduction, and flags risks above appetite. Bands are configurable (thresholds, named ranges or a cell-by-cell matrix such as the ICAO tolerability matrix). The validator reports a residual worse than the inherent rating, a reduction no control explains, a risk with no owner, and a band that leaves a score unrated.
Risk Matrix — Enterprise Principal Risks (Board ERM)
Eight principal risks for a fictional manufacturer on a 5×5 matrix with £-banded impacts: current controls cut total exposure Σ(L×I) from 99 to 55 (−44%) and move six risks down a band, while customer concentration, engineer retention, ransomware and a single-source alloy stay High — above the Medium appetite, each with a dated treatment action. Illustrative register.
Business & StrategyRisk Matrix — Information Security Risk Register (ISO 27005)
An ISO/IEC 27005 register for a fictional payroll SaaS covering nine threat scenarios, from ransomware in the build pipeline to supplier-payment fraud: controls cut exposure from 114 to 53 (−54%) and take all four Critical risks out of the top band, while the edge VPN, the build pipeline and the open-source supply chain stay High and above appetite, each with a treatment. Illustrative register.
ArchitectureRisk Matrix — High-Rise Construction Project Risk Register
A principal contractor's register for a fictional 18-storey residential tower, with impacts banded by cost and programme: controls bring exposure from 89 to 52 (−42%), and the two risks left above the Medium appetite are a delayed Building Safety Regulator Gateway 2 approval (High 12) and façade subcontractor insolvency (High 8), both with treatment actions. Illustrative register.
Project & PlanningRisk Matrix — Clinical Trial Quality Risks (ICH E6 RBQM, 3×3)
An ICH E6(R3) risk-based quality management assessment for a fictional 2,400-participant phase III trial on a 3×3 matrix: controls cut exposure from 50 to 25 (−50%), take seven of eight critical-to-quality risks down a band, and leave only slow recruitment rated High — above appetite, with 20 extra sites as the treatment. Illustrative register.
Research & AcademicRisk Matrix — Hospital Ward Patient Safety Register (5×5)
A patient safety register for a fictional elderly-care ward on the familiar NHS 5×5 consequence × likelihood matrix with Low, Moderate, High and Extreme bands: controls reduce exposure from 92 to 56 (−39%), and deterioration (10), falls (9), night staffing (9) and insulin errors (8) remain High, above the Moderate appetite, each with an improvement action. Illustrative register.
Risk & ReliabilityRisk Matrix — Airline Safety Risk Register (ICAO Tolerability Matrix)
A hazard log for a fictional ATR 72 operator rated on the ICAO Doc 9859 tolerability matrix — cell by cell, not by L×I, with 4B-style risk indices: mitigations bring the two Intolerable hazards, an unstable approach (4B) and wing contamination (3A), down to Tolerable, leaving all eight hazards within the Tolerable appetite. Illustrative register.
Risk & ReliabilityRisk Matrix — AI Customer Assistant Risk Register (NIST AI RMF)
An AI risk register for a fictional utility's LLM billing assistant, mapped to NIST AI RMF and EU AI Act transparency duties: across nine failure modes from wrong tariff answers to prompt injection, controls cut exposure from 99 to 45 (−55%) and take the Critical prompt-injection risk to Medium, leaving missed vulnerable-customer handoffs as the one High risk above appetite. Illustrative register.
AI & PipelinesRisk Matrix — Automotive Supply Chain Risk Register
A tier-1 brake supplier's supply chain register using group-policy thresholds (Low up to 4, Medium 5–9, High 10–15, Critical 16–25): controls move all eight risks down a band and cut exposure from 100 to 54 (−46%), leaving the single-source brake-controller MCU at High 12, above appetite, with dual-sourcing through PPAP as the treatment. Illustrative register.
Operations & OpsRisk Matrix — Payments Platform Migration Cutover Register (4×4)
A cutover register for a fictional fintech moving 38 million payment records, on a 4×4 project matrix: controls move every risk down a band and cut exposure from 67 to 33 (−51%), leaving card-scheme certification as the one High risk above the Medium appetite, with a pre-certification test cycle as its treatment. Illustrative register.
Project & PlanningRisk Matrix — Outdoor Festival Event Safety Risk Assessment
An event safety risk assessment for a fictional 40,000-a-day festival with custom bands (Low 1–4, Medium 5–9, High 10–16, Very high 20–25): controls cut exposure from 111 to 59 (−47%) and leave the main-stage crowd crush at High 10, above appetite, with a second pressure-relief barrier as the treatment. Illustrative register.
Operations & OpsRisk Matrix — Biosafety Level 2 Laboratory Risk Assessment
A BSL-2 risk assessment for a fictional viral-vector core covering biological, chemical, physical and ergonomic hazards: controls cut exposure from 87 to 40 (−54%), move eight of nine hazards down a band and leave every residual risk within the Medium appetite, the lentiviral needlestick highest at Medium 6. Illustrative register.
Life SciencesRisk Matrix — Offshore Wind Farm Construction and O&M Register
An owner's register for a fictional 1.2 GW offshore wind farm spanning grid, cables, installation, turbines and consents: controls cut exposure from 94 to 51 (−46%), and a delayed grid connection stays High 12 above the Medium appetite, with an interim 400 MW connection offer as the treatment. Illustrative register.
Risk & Reliability