First, estimate how likely it is that your risk is going to turn into a real issue:
1 = It is very unlikely that this will happen.
5 = It is going to happen.
Second, score how bad the impact is if your risk does turn into a real issue:
1 = It will not make much difference to our project.
5 = It will cause our project to fail.
Finally, multiply these two together, and you get a score from 1 to 25 to compare risk levels across your risks, and prioritise your attention and resources accordingly.
More about Risk Scoring
Risk Scoring Matrix: Impact vs Likelihood
- A score of 1 is “Low Risk”.
- A score of 25 is “Extremely High Risk”.
Assigning Likelihood Values
- Rare: A very unlikely event. It could happen, but probably never will. Below 5%
- Unlikely: Not expected. Slight possibility. An improbable sequence of events. 5% – 25%
- Possible: Moderate likelihood. Foreseeable. May have occurred in projects like this before. 25% – 50%
- Likely: Strong possibility. High likelihood. An easily foreseeable event. 50% – 75%
- Almost Certain: Almost certain without any intervention. Above 75%.
Assigning Risk Impact Values
- Insignificant: The project will have to make some minor changes to scope. Resolvable by project team. Can be managed. Acceptible.
- Minor: Some changes to deliverables.
Outside of Project Tollerances or Contingency.
Adjustment to scope with some impact.
- Moderate: One or more areas likely not to deliver as planned. Descoping required. Significant impact.
- High: Significant descoping required.
- Extreme: Serious failure of project objectives. Disastrous Impact.
You then multiply your Impact and Likelihood scores together. See the Risk Scoring Matrix below to quickly ascertain the risk level.
Risk Scoring Matrix
Use this scoring to prioritise your risks
This risk scoring is a useful tool to prioritise the effort in your project to mitigate the most important risks first.
Use Risk Mitigation to reduce the risk levels
As you move through your project, and manage your risks with your Risk Log, you will plan mitigation steps for each risk. These mitigation steps may not remove the risk completely, but they should reduce the impact and/or the likelihood of that risk.
Problems with Scoring Risks with a Matrix
There are many ways to allocate weighting to risks, and to group severity, with no right or wrong answer. The allocation of severity groupings helps you give summaries to your colleagues, but the groupings you choose will need to vary depending on the project type, size and environment.
Example Guidance for Project Managers according to Risk Severity
Escalate immediately to project authorities.
Inform project authorities.
Act on mitigation and ensure you have response plans ready.
Manage risk and escalate in normal reporting.
Watch carefully for change in exposure.
Short on time?
Use these templates to help with business best practice:
Operations is a key function in any business. Led by the COO, operations can cover a wide range of business-critical processes.
- Project Management
Related Business Best Practices
You need a Risk Log so that you can track and manage your project risk. How do you create one and then use a Risk Log?
All Business Best Practice
See all Business Best Practice here.