Risk matrix: how to build it and prioritise threats

A risk matrix crosses the likelihood of a threat occurring with the impact it would cause. The result shows which risks call for immediate action and which can wait. It is the tool that turns an endless list of threats into an order of priorities that holds up in front of the board. This guide shows how to build a consistent matrix, define likelihood and impact without guesswork, choose the scale and avoid the mistakes that hollow out the exercise.

The starting point is usually uncomfortable. A spreadsheet with dozens of risks, all marked "high", and no clear way to decide where to begin. The matrix solves this by giving each risk a relative position. The conversation stops being "everything is urgent" and becomes "these five risks come first, and for these reasons".

What a risk matrix is and what it does in GRC

A risk matrix is a visual representation, usually a grid, that places each risk on two axes: the likelihood of occurrence and the severity of impact. Combining those two values produces a risk level, usually translated into colour bands. The result is a map that shows, at a glance, where the organisation's exposure is concentrated.

Within a GRC programme, the matrix serves three practical purposes. First, it creates a common language: the technical team, legal and the executive team discuss the same risk using the same criteria. Second, it guides the allocation of resources, because budget and time are finite and need to go where exposure is greatest. Third, it creates traceability, since every decision to accept, mitigate, transfer or avoid a risk is recorded with its rationale.

The context makes this work ever more demanding. In Brazil, the average cost of a data breach was R$ 7.19 million (Brazilian reais) in the 2025 edition of IBM's Cost of a Data Breach report, which covered breaches from March 2024 to February 2025 (IBM news release, in Portuguese). The 2026 edition raised the figure to R$ 7.44 million. With figures of that order, prioritising risk stops being a compliance exercise and becomes a financial decision. The matrix alone, however, does not say how much each risk costs. That limit is the subject of the article The 5×5 matrix does not say what risk costs, and we come back to it below.

Professional analysing a dashboard of risk data and indicators on a computer screen

The methodological basis comes from established standards. ISO 31000:2018, the international standard of guidelines for risk management, describes the risk assessment process in three steps: identification, analysis and evaluation. It does not mandate a matrix. The techniques for carrying out those steps are in IEC 31010:2019, which complements ISO 31000 and treats the consequence/likelihood matrix as one technique among many, useful above all for ranking and screening risks. Anchoring the matrix criteria in that process keeps it from being seen as opinion and makes it easier to defend in audits. In information security, ISO 27005 applies the same logic to the risk assessment that ISO 27001 requires.

How to define likelihood and impact consistently

Consistency is what separates a useful matrix from guesswork. The most common problem rarely lies in the structure of the grid; it lies in the lack of written criteria for the two axes. When "medium likelihood" means different things to each assessor, the whole matrix loses value. The practical rule is simple: define objective ranges for each level, document them and require everyone to apply them.

For likelihood, prefer ranges anchored in frequency whenever possible. An example of a five-level scale, with no gaps between the ranges:

Very low (1): less than once every five years.
Low (2): once every two to five years.
Medium (3): once every one to two years.
High (4): two to eleven times a year.
Very high (5): monthly or more often.

For impact, the recurring mistake is to measure everything in money alone. A robust criterion combines distinct dimensions and uses the most severe of them to rate the risk. The most common dimensions are:

Financial: direct loss, fines and recovery costs.
Operational: downtime of critical processes.
Regulatory: exposure to sanctions under the LGPD (Brazil's General Data Protection Law), to requirements of Brazil's National Monetary Council (CMN) and Central Bank, or of other applicable regulators.
Reputational: erosion of trust among customers, partners and the market.

Threat vectors should also inform likelihood. According to Verizon's 2026 Data Breach Investigations Report, 31% of breaches began with the exploitation of vulnerabilities, which for the first time in 19 years overtook stolen credentials as the main point of entry. The same report shows that 48% of breaches involved a third party, which weighs on the likelihood of supplier-related risks (see the article on third-party risk and CMN Resolution 4,893). For specific vulnerabilities, signals such as EPSS and the KEV catalogue help calibrate likelihood with evidence rather than perception, as the guide on prioritising vulnerabilities with CVSS, EPSS and KEV shows.

The 5x5 matrix and prioritisation criteria

The 5x5 scale is one of the most widely used in GRC programmes because it balances granularity and simplicity. With five levels on each axis, it produces 25 combinations, enough to tell similar risks apart without the false precision of ten-level scales, where the difference between a 7 and an 8 is impossible to justify. A 3x3, on the other hand, is usually too coarse and stacks different risks in the same cell.

In practice, each risk's score is usually the product of the two axes. A risk with likelihood 4 and impact 5 scores 20; another with likelihood 2 and impact 3 scores 6. An example of severity bands, which each organisation should adjust to its risk appetite:

Green (low, 1 to 4): acceptable risk, routine monitoring.
Yellow (moderate, 5 to 9): requires a mitigation plan with a set deadline.
Orange (high, 10 to 15): requires priority treatment and management-level approval.
Red (critical, 16 to 25): demands immediate action and executive visibility.

The score is a ranking, not a quantity. Likelihood and impact in five steps are ordinal labels: 20 is not twice 10, and adding up the scores of thirty risks does not give total exposure. "Impact 5" can hold losses that differ by two orders of magnitude. The matrix works well for triage and ranking. When the decision is about budget, between risks that are already red, it pays to quantify in money and probability, as the articles The 5×5 matrix does not say what risk costs and Cyber Risk Quantification (CRQ) explain.

Prioritisation, therefore, should not stop at the score. Two risks with the same score can have different urgency. Useful tie-breakers include how quickly the risk can materialise, the cost and feasibility of the available control, and concentration of exposure, that is, whether a single failed control affects several risks at once. Prioritising by score alone is a start; taking these factors into account is what sets a mature programme apart.

It is worth distinguishing, in the matrix itself, inherent risk from residual risk. Inherent risk is the exposure before any control; residual risk is what remains after the controls are applied. A matrix that shows only inherent risk overstates exposure; one that shows only residual risk can hide reliance on a single control. Solid programmes show both and track the gap between them.

Common mistakes and how to fix them

Some mistakes recur often and drain the matrix of value. Recognising them is half the fix.

Subjective scales. When "high" and "medium" have no written definition, each assessor rates differently. Fix it by documenting objective ranges and training assessors with examples.
Impact measured only in money. Regulatory and reputational risks are underestimated when the only criterion is financial. Fix it by using several impact dimensions and rating by the most severe.
A static matrix. A matrix built once and never reviewed ages quickly, because the environment changes. Fix it by setting a reassessment cycle and update triggers, such as onboarding a critical supplier or a regulatory change.
Artificial clustering in the middle. Assessors tend to avoid the extremes and stack everything in the "medium" band. Fix it by requiring a written rationale for each rating and reviewing outliers.
A matrix disconnected from controls. A matrix that is not linked to existing controls becomes a decorative document. Fix it by associating each risk with the controls that treat it and the person accountable for them.

The fifth mistake is the most expensive in the long run. Without a link between risks, controls and owners, the organisation loses the ability to answer a simple board question: "is this risk under control today?". That traceability is what mature enterprise risk management needs to sustain, and the topic is explored in the guide on enterprise risk management software in Brazil.

Automating the risk matrix with GRC platforms

A spreadsheet works to get started, but it does not scale. When the inventory grows to hundreds of risks spread across business units, suppliers and frameworks, keeping the matrix up to date by hand takes time and introduces errors. That is when a GRC platform becomes an operational necessity.

A good platform changes the matrix in three ways. First, it connects each risk to the corresponding assets, controls and owners, so that the rating reflects the current state of the controls rather than an old snapshot. Second, it makes it easier to keep prioritisation alive: when a control fails or a new threat vector emerges, it becomes clear which risks need reassessment, without redoing the whole grid. Third, it reuses the same control inventory across frameworks such as ISO 27001, the LGPD, SOC 2 and NIST CSF, instead of keeping the same information in several places.

That integration is what Eagle, Futture's Enterprise Risk Intelligence platform, was designed to provide. Instead of treating the matrix as an isolated document, Eagle brings risk taxonomy, appetite, tolerance and heatmaps into one model and connects risk scenarios to assets, suppliers, controls and cyber exposure, from inherent to residual risk. AI supports classification and context-based prioritisation, but the model is human-in-the-loop: the user reviews, approves, rejects or adjusts every relevant result, and the decision to accept or treat a risk remains human and traceable.

Automation does not replace judgement. It reduces the mechanical work that today takes up much of risk teams' time, such as collecting evidence, updating spreadsheets and reconciling frameworks, and gives that time back to the analysis that genuinely requires experience. A connected matrix is one the organisation can keep reliable month after month, not just on audit day.

Next step

Start by auditing the matrix you already have. Pick the five risks rated highest and check three things for each: whether the likelihood and impact criteria are documented, whether there is an associated control with a named owner, and whether the rating was reviewed within the cycle set by your policy, for example in the last three months. Wherever any answer is "no", you have found the next priority for your risk programme and a concrete case for moving from the spreadsheet to a connected platform.

Further reading: How the CISO should report cyber risk to the board.

Frequently asked questions

What is a risk matrix?

It is a visual tool that crosses the likelihood of a risk occurring with the impact it would cause and rates each threat on a severity scale. It helps prioritise where the organisation should invest attention and resources first.

What is the difference between a 3x3 and a 5x5 matrix?

A 3x3 uses three levels of likelihood and impact and is simpler, but coarse. A 5x5 uses five levels on each axis, which gives enough granularity to tell similar risks apart without the false precision of larger scales. The 5x5 is one of the most widely used scales in GRC programmes, but it is still ordinal: it ranks risks, it does not say how much a risk costs.

How do you define likelihood and impact objectively?

Write down clear ranges for each level. Likelihood can use expected frequency per year; impact can combine financial loss, operational disruption, regulatory exposure and reputational damage, rating by the most severe dimension. The goal is for two different assessors to reach the same result.

How often should the risk matrix be reviewed?

There is no single deadline. ISO 31000 asks for monitoring and review to be planned as part of the process, and many organisations adopt quarterly or half-yearly cycles. What matters is to set the cycle in your policy and to reassess whenever there is a relevant change, such as a new critical supplier, a regulatory change or an incident.

Risk Matrix: How to Build It and Prioritise Threats