The five by five risk matrix: problems and practical fixes

A five by five risk matrix rates likelihood and impact from one to five and combines them into a color. It works when each level has a written definition and the combination table is deliberate. It fails when scales are vague, everything lands in the middle, and the color is treated as a measurement.

Why teams like it

It is fast. A workshop can rate dozens of scenarios in an hour. It is also easy to explain to non-specialists, and it produces a ranked list.

NIST SP 800-30 acknowledges the strength: qualitative levels such as very low, low, moderate, high and very high are good for communicating results to decision makers. It also names the weakness. The range of values is small, which makes ranking within the set of risks difficult, and different experts can produce very different results unless each value is clearly defined or illustrated by examples.

Failure modes

• Undefined levels. "Likely" means weekly to one person and yearly to another.
• Clustering. Most items end up at three, which tells nobody anything.
• Multiplying ordinal numbers. A rating of 4 is not twice a rating of 2. Multiplying them creates scores that look like arithmetic but are not.
• One cell, many costs. Items in the same cell can differ greatly in real loss.
• Colors drive decisions. People argue over whether a risk is orange or red instead of what to do.

Fixes that cost little

1. Write definitions with anchors. For likelihood, give time ranges. For impact, give concrete examples such as a service outage of a stated length or exposure of a stated type of data.
2. Use an even number of levels. Four levels remove the comfortable middle.
3. Add a rationale. One sentence on why a rating was chosen. NIST says annotating values improves repeatability.
4. Define the combination table yourself. Do not multiply. Decide which cell is high on purpose.
5. Split big categories. If most risks are "high impact", the top level needs breaking down.
6. Show uncertainty. Mark ratings that rest on a guess and revisit them first.

When to move beyond it

If a decision involves a large sum, or two risks in the same cell compete for the same budget, estimate each in money ranges. NIST describes semi-quantitative scales as a middle option, where numeric bins translate into qualitative terms while still allowing finer comparison.

Calibrate as a group

Rate five familiar incidents together at the start of a workshop. Compare answers, discuss differences, then adjust the definitions. That fifteen minute exercise tends to remove most disputes about what "medium" means.

Quick check

Sources

• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

Last reviewed: 19 October 2026.