IT risk assessment matrix

Enter the IT risks you are worried about, give each a likelihood and an impact from 1 to 4, and this worksheet will score them, plot them on a 4 × 4 matrix, rank them, suggest which kind of treatment to look at first, and produce a summary you can paste into your own risk register.

Enter your risks

How the score works

Each risk gets a likelihood and an impact, each an integer from 1 to 4. The score is the two multiplied together. The score is banded, and risks are ranked by score. These are the written-out definitions; replace the impact anchors with thresholds that match your own organisation before relying on any result.

Likelihood	Label	Definition (state your horizon, for example twelve months)
1	Unlikely	Would need several independent controls to fail or an unusual combination of circumstances. No near miss in your own history.
2	Possible	Could plausibly happen. Has happened to comparable organisations or you have had a near miss, and at least one effective control is in place.
3	Likely	Expected at least once in the horizon given current controls, or the control is known to be weak or inconsistently applied.
4	Almost certain	Happening now, recurring, or the exposure is open and known with no effective control.

Impact	Label	Example anchors (replace with your own)
1	Minor	Absorbed in normal operations. A workaround exists. No customer, regulator or contractual consequence.
2	Moderate	A service is degraded or unavailable for part of a working day. Internal rework. Limited exposure of internal data.
3	Major	A critical service is down for days, or an obligation is breached, or customers’ personal data is exposed. Visible to customers.
4	Severe	Prolonged loss of a critical service, unrecoverable data loss, or consequences that threaten a major contract, a licence or the organisation’s viability.

Score	Band	Reached by (likelihood x impact)
1 to 3	Low	1×1, 1×2, 1×3, 2×1, 3×1
4 to 6	Medium	1×4, 2×2, 2×3, 3×2, 4×1
8 to 9	High	2×4, 3×3, 4×2
12 to 16	Critical	3×4, 4×3, 4×4

Multiplying ordinal scores has known weaknesses: different risks can share a score, and risks cluster at a few values. The risk scoring guide explains these and how to work around them, which is why the table above shows both factors and not just the score.

How treatment suggestions are chosen

The suggestions follow fixed rules, so you can disagree with them precisely. A risk is impact-led when impact exceeds likelihood, likelihood-led when the reverse, and balanced when they are equal.

Band	Examine first	Other options listed
Critical	Mitigate	Avoid; transfer. Accept is not suggested without an explicit decision by someone with authority over the risk.
High	Mitigate	Transfer when impact is 3 or more; avoid when likelihood is 3 or more.
Medium, impact-led	Transfer	Mitigate; accept.
Medium, likelihood-led	Mitigate	Accept.
Medium, balanced	Accept	Mitigate.
Low	Accept	Mitigate if cheap.

The risk treatment guide explains each option and how to record the decision and the residual risk. The treatment threshold you choose above only controls which rows are flagged “at or above threshold”; it does not change any score.

What this tool is not

• It is not an assessment of your systems. It never looks at them.
• It is not a certification, a formal audit, an attestation or evidence of compliance with any framework, and it carries no endorsement from any standards body or framework owner.
• It does not replace judgement: the output is only as good as the likelihood and impact values you give it.
• It does not save your data. Copy the summary or the table before leaving the page.

To go further, read about building a risk register that these entries can live in, and about reporting the results to a board.