Skip to content
flowss
Start freeChecking your session
Risk matrix templates

Risk Matrix — Enterprise Principal Risks (Board ERM)

Eight principal risks for a fictional manufacturer on a 5×5 matrix with £-banded impacts: current controls cut total exposure Σ(L×I) from 99 to 55 (−44%) and move six risks down a band, while customer concentration, engineer retention, ransomware and a single-source alloy stay High — above the Medium appetite, each with a dated treatment action. Illustrative register.

Risk matrixBusiness & StrategyRisk matrix syntax docs
Template previewRisk matrix
Halden Industries — principal risks, FY2027 Q1Audit & Risk Committee · inherent rating against residual after current controlsHEAT MAP · residual position, arrows from inherent11LOWLOW22LOWLOW33LOWLOW44MEDIUMMEDIUM55MEDIUMMEDIUM22LOWLOW44MEDIUMMEDIUM66MEDIUMMEDIUM88HIGHHIGH1010HIGHHIGH33LOWLOW66MEDIUMMEDIUM99HIGHHIGH1212HIGHHIGH1515CRITICALCRITICAL44MEDIUMMEDIUM88HIGHHIGH1212HIGHHIGH1616CRITICALCRITICAL2020CRITICALCRITICAL55MEDIUMMEDIUM1010HIGHHIGH1515CRITICALCRITICAL2020CRITICALCRITICAL2525CRITICALCRITICALOP-06FI-08FI-05CO-07CY-02SU-03ST-01OP-06PE-04CO-07FI-08SU-03ST-01PE-04FI-05CY-02Rare<5% in 3 yrs1Unlikely5–20%2Possible20–50%3Likely50–80%4Almost certain>80%51Minimal<£1m2Minor£1–5m3Moderate£5–20m4Major£20–50m5Severe>£50mLIKELIHOOD →IMPACT →R1residual position (after controls)R1inherent positioneffect of existing controlsappetite boundary · red ring = above it25L×I score and rating bandRISK PROFILE BY BANDInherentResidual (current)Critical2 → 0High6 → 4Medium0 → 4Low0 → 0Low 1–3 · Medium 4–6 · High 8–12 · Critical 15–25EXPOSURE Σ L×I55residual, after current controlsfrom 99 inherent · −44%HIGHEST RESIDUAL RISKST-01Largest automotive customer does notrenew its platform contract10 · Highowner Chief Commercial OfficerRISK APPETITEMedium or below4 risks above: ST-01, PE-04, CY-02, SU-03Risk register8 risks · sorted by residual rating, then score#IDRISK, CONTROLS AND ACTIONSOWNERINHERENTRESIDUALTARGETCHANGESTRATEGICLargest automotive customer does not renew its platformcontractExecutive sponsor and quarterly business reviews with the customerSecond-source qualification under way at two adjacent OEMs→Win the 2028 platform award to cut customer concentration below 25% ofrevenue — due 2027-12 · CCO1ST-01Chief CommercialOfficer3 × 515 · Critical2 × 510 · HighABOVE APPETITE2 × 48 · High−5−33%→ stablePEOPLELoss of critical tooling engineers to competitorsRetention awards for 14 critical rolesApprenticeship pipeline of 12 trainees a year→Launch a technical career ladder with market-benchmarked pay — due2027-06 · CPO2PE-04Chief PeopleOfficer4 × 312 · High3 × 39 · HighABOVE APPETITE—−3−25%↑ risingCYBERRansomware encrypts the ERP and the plant executionsystemsImmutable backups with quarterly restore testsEDR on every endpoint with 24×7 managed detection and responsePhishing-resistant MFA for all remote and privileged access→Segment plant networks from corporate IT into IEC 62443 zones — due2027-09 · Head of OT Security3CY-02Chief InformationOfficer4 × 520 · Critical2 × 48 · HighABOVE APPETITE1 × 44 · Medium−12−60%↓ fallingSUPPLY CHAINSingle-source aluminium alloy supplier failsSix weeks of safety stock on the three critical alloysMonthly supplier credit monitoring with early-warning alerts→Qualify a second alloy supplier in Spain — due 2027-10 · Procurement Director4SU-03ProcurementDirector3 × 412 · High2 × 48 · HighABOVE APPETITE1 × 44 · Medium−4−33%FINANCIALEuro weakness erodes margin on euro-denominated salesRolling 18-month hedge covering 75% of forecast euro receiptsEuro-denominated purchasing as a natural hedge5FI-05Group CFO4 × 312 · High2 × 36 · Medium—−6−50%COMPLIANCELate or qualified first CSRD sustainability reportCSRD readiness programme with an external limited-assurance dry run6CO-07General Counsel3 × 39 · High2 × 36 · Medium—−3−33%↓ fallingOPERATIONALFire at the Leeds casting plant halts production for eight weeksSprinklers and aspirating smoke detection, insurer-audited annuallyBusiness-interruption cover for 18 months of gross profit7OP-06Chief OperatingOfficer2 × 510 · High1 × 44 · Medium—−6−60%FINANCIALEnergy price spike raises melting costsLayered forward purchasing of 24 months of gas and power8FI-08Group CFO3 × 39 · High2 × 24 · Medium—−5−56%FINDINGS8 risks rated — inherent 2 Critical, 6 High; after current controls 4 High, 4 Medium.Total exposure Σ(L×I) falls from 99 to 55 after current controls — a 44% reduction.Controls move 6 of 8 assessed risks into a lower band; 2 keep their inherent band.4 of 8 risks sit above the Medium appetite on residual rating — ST-01 (High 10), PE-04 (High 9), CY-02 (High 8), SU-03 (High 8); each has a treatment action.Highest residual risk: ST-01 Largest automotive customer does not renew its platform contract — High 10, owner Chief Commercial Officer.Controls do most for CY-02: 20 → 8 (−60%).Illustrative register for a fictional manufacturer; likelihood and impact ratings are examples, not an assessment.

Make it your own.

title "Halden Industries — principal risks, FY2027 Q1"
subtitle "Audit & Risk Committee · inherent rating against residual after current controls"
likelihood-levels: Rare (<5% in 3 yrs), Unlikely (5–20%), Possible (20–50%), Likely (50–80%), Almost certain (>80%)
impact-levels: Minimal (<£1m), Minor (£1–5m), Moderate (£5–20m), Major (£20–50m), Severe (>£50m)
bands: Low 1-3, Medium 4-6, High 8-12, Critical 15-25
appetite: Medium
note "Illustrative register for a fictional manufacturer; likelihood and impact ratings are examples, not an assessment."

risk ST-01 "Largest automotive customer does not renew its platform contract"
  category: Strategic
  owner: Chief Commercial Officer
  likelihood: 3
  impact: 5
  control "Executive sponsor and quarterly business reviews with the customer"
  control "Second-source qualification under way at two adjacent OEMs"
  residual: 2x5
  action "Win the 2028 platform award to cut customer concentration below 25% of revenue" due: 2027-12 owner: "CCO"
  target: 2x4
  trend: stable

risk CY-02 "Ransomware encrypts the ERP and the plant execution systems"
  category: Cyber
  owner: Chief Information Officer
  likelihood: 4
  impact: 5
  control "Immutable backups with quarterly restore tests"
  control "EDR on every endpoint with 24×7 managed detection and response"
  control "Phishing-resistant MFA for all remote and privileged access"
  residual: 2x4
  action "Segment plant networks from corporate IT into IEC 62443 zones" due: 2027-09 owner: "Head of OT Security"
  target: 1x4
  trend: falling

risk SU-03 "Single-source aluminium alloy supplier fails"
  category: Supply chain
  owner: Procurement Director
  likelihood: 3
  impact: 4
  control "Six weeks of safety stock on the three critical alloys"
  control "Monthly supplier credit monitoring with early-warning alerts"
  residual: 2x4
  action "Qualify a second alloy supplier in Spain" due: 2027-10 owner: "Procurement Director"
  target: 1x4

risk PE-04 "Loss of critical tooling engineers to competitors"
  category: People
  owner: Chief People Officer
  likelihood: 4
  impact: 3
  control "Retention awards for 14 critical roles"
  control "Apprenticeship pipeline of 12 trainees a year"
  residual: 3x3
  action "Launch a technical career ladder with market-benchmarked pay" due: 2027-06 owner: "CPO"
  trend: rising

risk FI-05 "Euro weakness erodes margin on euro-denominated sales"
  category: Financial
  owner: Group CFO
  likelihood: 4
  impact: 3
  control "Rolling 18-month hedge covering 75% of forecast euro receipts"
  control "Euro-denominated purchasing as a natural hedge"
  residual: 2x3

risk OP-06 "Fire at the Leeds casting plant halts production for eight weeks"
  category: Operational
  owner: Chief Operating Officer
  likelihood: 2
  impact: 5
  control "Sprinklers and aspirating smoke detection, insurer-audited annually"
  control "Business-interruption cover for 18 months of gross profit"
  residual: 1x4

risk CO-07 "Late or qualified first CSRD sustainability report"
  category: Compliance
  owner: General Counsel
  likelihood: 3
  impact: 3
  control "CSRD readiness programme with an external limited-assurance dry run"
  residual: 2x3
  trend: falling

risk FI-08 "Energy price spike raises melting costs"
  category: Financial
  owner: Group CFO
  likelihood: 3
  impact: 3
  control "Layered forward purchasing of 24 months of gas and power"
  residual: 2x2