Risk Heatmap

How it works

1. 1List your risks with an owner, then rate each one for likelihood and impact from 1 to 5.
2. 2Each risk is plotted on the 5x5 grid by its reference, so a cluster in the top-right corner is immediately obvious.
3. 3The score is likelihood multiplied by impact. Cells are banded low, medium, high and critical.
4. 4Download the grid as PNG for a slide, or SVG if you want to restyle it. The underlying list exports as CSV.

Common questions

Why multiply likelihood by impact?

It is the standard convention and it has the right property: a near-certain annoyance and a remote catastrophe both land in the middle, while something both likely and severe rises to the top. It is a ranking aid, not a measurement.

Where do the band thresholds come from?

Scores of 15 and above are banded critical, 10 to 14 high, 5 to 9 medium, and below 5 low. These are the usual cut-offs but they are a convention — if your organisation uses different ones, the numbers and colours still map the same way.

Can I pull risks from my RAID log?

Yes. If you have used the RAID Log Builder in this browser, its risks are loaded here automatically with their scores. The two tools share the same register.

What if several risks land in the same cell?

Up to four references are printed in the cell and the rest are summarised as a count. If one cell is crowded, that is usually a sign the scoring is not discriminating enough — consider whether they really are all equally likely and equally severe.

Is a heatmap enough on its own?

No. A grid tells you what to worry about, not what to do. Every risk in the top two bands should have a named owner and an action, which is what the RAID log is for.