IT risk assessment matrix

Enter the IT risks you are worried about, give each a likelihood and an impact from 1 to 4, and this worksheet will score them, plot them on a 4 × 4 matrix, rank them, suggest which kind of treatment to look at first, and produce a summary you can paste into your own risk register.

What a score here means. It is a working estimate calculated from the numbers you type in. It is not a certification, a formal audit, an attestation or evidence of compliance, and it does not measure, scan or test any real system. Your data stays in your browser: nothing is sent anywhere and nothing is stored, so refreshing the page clears the worksheet. Copy the summary before you leave.

Enter your risks

This tool needs JavaScript to run. Without it, you can still use the definitions and the scoring method further down this page by hand, or follow the risk scoring guide. No data is collected either way.

Write each risk as a short statement of what could go wrong to which asset. Fields marked optional can be left alone.

Risk (what could go wrong, to what)

For example: Remote access to the finance server relies on passwords alone. Up to 120 characters.

Results

Working estimate only. Not a certification, formal audit, attestation or evidence of compliance. The scores come from the values you entered.

No risks entered yet.

Add a risk, or load the example register, to see the ranking, treatment suggestions and a summary.

How to read the matrix: likelihood runs left to right and impact bottom to top. The small number in each cell is its score. Each plotted label is a risk ID from the table.

Ranked register

Treatment threshold: flag risks at or above

* shares its score with another risk; ties are broken by impact, then likelihood, then order of entry. Treatment suggestions name a type to examine first and are not advice about your systems.
Rank	ID	Risk	L x I	Score	Band	Planned residual	Treatment to consider first	Actions

Register-ready summary

Plain text. Select it, or use the buttons.

How the score works

Each risk gets a likelihood and an impact, each an integer from 1 to 4. The score is the two multiplied together. The score is banded, and risks are ranked by score. These are the written-out definitions; replace the impact anchors with thresholds that match your own organisation before relying on any result.

Likelihood	Label	Definition (state your horizon, for example twelve months)
1	Unlikely	Would need several independent controls to fail or an unusual combination of circumstances. No near miss in your own history.
2	Possible	Could plausibly happen. Has happened to comparable organisations or you have had a near miss, and at least one effective control is in place.
3	Likely	Expected at least once in the horizon given current controls, or the control is known to be weak or inconsistently applied.
4	Almost certain	Happening now, recurring, or the exposure is open and known with no effective control.

Impact	Label	Example anchors (replace with your own)
1	Minor	Absorbed in normal operations. A workaround exists. No customer, regulator or contractual consequence.
2	Moderate	A service is degraded or unavailable for part of a working day. Internal rework. Limited exposure of internal data.
3	Major	A critical service is down for days, or an obligation is breached, or customers’ personal data is exposed. Visible to customers.
4	Severe	Prolonged loss of a critical service, unrecoverable data loss, or consequences that threaten a major contract, a licence or the organisation’s viability.

Score	Band	Reached by (likelihood x impact)
1 to 3	Low	1×1, 1×2, 1×3, 2×1, 3×1
4 to 6	Medium	1×4, 2×2, 2×3, 3×2, 4×1
8 to 9	High	2×4, 3×3, 4×2
12 to 16	Critical	3×4, 4×3, 4×4

Multiplying ordinal scores has known weaknesses: different risks can share a score, and risks cluster at a few values. The risk scoring guide explains these and how to work around them, which is why the table above shows both factors and not just the score.

How treatment suggestions are chosen

The suggestions follow fixed rules, so you can disagree with them precisely. A risk is impact-led when impact exceeds likelihood, likelihood-led when the reverse, and balanced when they are equal.

Band	Examine first	Other options listed
Critical	Mitigate	Avoid; transfer. Accept is not suggested without an explicit decision by someone with authority over the risk.
High	Mitigate	Transfer when impact is 3 or more; avoid when likelihood is 3 or more.
Medium, impact-led	Transfer	Mitigate; accept.
Medium, likelihood-led	Mitigate	Accept.
Medium, balanced	Accept	Mitigate.
Low	Accept	Mitigate if cheap.

The risk treatment guide explains each option and how to record the decision and the residual risk. The treatment threshold you choose above only controls which rows are flagged “at or above threshold”; it does not change any score.

What this tool is not

It is not an assessment of your systems. It never looks at them.
It is not a certification, a formal audit, an attestation or evidence of compliance with any framework, and it carries no endorsement from any standards body or framework owner.
It does not replace judgement: the output is only as good as the likelihood and impact values you give it.
It does not save your data. Copy the summary or the table before leaving the page.

To go further, read about building a risk register that these entries can live in, and about reporting the results to a board.