How to read a risk heat map on Mac
You can do this with RiskOS, a risk register for macOS. Twenty-five cells, four colours, and a count in each one that says more than the colour does.
A heat map is the register with the words taken out. Twenty-five cells, a colour each, and a count in every cell saying how much of your exposure has collected there. Read properly it answers three questions in a few seconds: where the worst of it sits, whether that corner holds one risk or nine, and whether anything has drifted somewhere you already said you would not tolerate.
Colour is never the only signal. Every band in RiskOS pairs its colour with a symbol and the written word, so the map reads the same to someone who cannot separate one hue from the next.
Where the heat map lives
There are two maps, and they answer different questions. Choose Dashboard in the sidebar for the register drawn as a single grid: every risk placed by its rating, with cells carrying counts rather than titles. Then choose Risks, select a row, and open Assessment in the panel on the right. The matrix there is about one risk only, and instead of counts it carries three markers and a legend.
The same grid appears a third time in Reports, where risk matrix is one of the sections you can switch on. All four outputs are drawn from one snapshot, so the map in a board pack always agrees with the register table printed behind it.
Read the map, step by step
-
Open the Dashboard
Choose Dashboard in the sidebar. This is the register seen as a shape rather than a list. Widen the window until all five columns are comfortably legible; RiskOS remembers the sidebar and panel widths you leave behind, so it is a one-off adjustment.
-
Find the axes before you read the colours
One axis runs the likelihood scale — Rare, Unlikely, Possible, Likely, Almost Certain. The other runs impact — Insignificant, Minor, Moderate, Major, Severe. Each cell is where one rating from each scale meets, and the score it stands for is the two multiplied, from 1 in the mildest corner to 25 in the worst.
-
Start where Almost Certain meets Severe
That cell is 25, the highest score the grid can produce and the only cell on it that holds that score. Work outwards from there. Reading from the calm corner inwards arrives at the same handful of rows a good deal later, so begin where a board would begin.
-
Read the counts, not only the colours
A cell holding one risk and a cell holding six look identical if you read colour alone, and they call for different conversations. The number in a cell is how many risks carry that exact pair of ratings. Read the count first and the colour second.
-
Find out which risks a cell is counting
Choose Risks and filter by band to pull the rows behind a colour into the table. The filter icon fills while any filter is on, so you will not mistake a narrowed table for the whole register. If it is a view you rebuild often, Save Current Filter… names the combination and brings it back in one click.
-
Open a risk to see its own matrix
Select a row and open Assessment in the panel. The matrix there carries three markers and a legend: inherent, residual and target. Move a likelihood or an impact stepper and the markers glide to their new cells rather than jumping, so you can see which one moved and how far.
-
Measure the distance between inherent and residual
Inherent is the exposure with nothing standing in its way; residual is what is left once the effectiveness of your linked controls is taken into account. The distance between the two markers is the clearest picture you will get of what those controls are actually doing. If they share a cell, nothing you have linked is reducing anything yet.
-
Check the map against your appetite
Appetite is the highest residual score your organisation tolerates, set in Settings ▸ Appetite. Any risk above it is flagged everywhere it appears, including in the panel header. In the register, the over-appetite filter narrows the table to exactly those rows; in Review, Above appetite is one of the scopes, with a live count beside it before you start.
-
Put the matrix in front of other people
Choose Reports, switch on risk matrix, fill in the report title, organisation and prepared-by fields, and export. ⇧⌘P writes the PDF, ⇧⌘E writes a self-contained HTML file, and ⌘P sends the same pages to a printer.
What the colours are doing
A cell's colour carries one thing: the band its score falls into. That is less information than it looks like, because two cells wearing the same colour can be several points apart. Colour is a way to find the part of the grid worth reading, not a substitute for the number underneath it.
| Band | Score | What a cell in that colour is telling you |
|---|---|---|
| Low | 1–4 | Tolerable as it stands. Keep it under review at the cadence you set and spend your attention elsewhere. |
| Medium | 5–9 | Worth treating where treatment is cheap. Watch for movement rather than acting immediately. |
| High | 10–16 | Needs a named owner, a treatment plan and a date. Most registers carry more of these than anyone expects. |
| Critical | 17–25 | Escalate. These are the rows an executive summary exists to carry, and the first cells to read on any map. |
Each band pairs its colour with a symbol and the written word wherever it appears. That is not only an accessibility measure: a report photocopied in black and white still reads correctly, because the word sits beside the colour.
Why the cells are not spread evenly
Twenty-five cells do not produce twenty-five scores. Multiplying two numbers between 1 and 5 gives only fourteen distinct results — 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20 and 25 — so 7, 11, 13, 14, 17 to 19 and 21 to 24 have no cell to sit in at all. The band boundaries are cut around where real scores cluster, which is why the map is lopsided by design.
| Band | Cells on the grid | Scores that actually appear |
|---|---|---|
| Low | 8 of 25 | 1, 2, 3, 4 |
| Medium | 7 of 25 | 5, 6, 8, 9 |
| High | 7 of 25 | 10, 12, 15, 16 |
| Critical | 3 of 25 | 20, 25 |
The Critical corner is deliberately small
Only three cells reach Critical, and they share a corner: Major with Almost Certain, Severe with Likely, and Severe with Almost Certain. A band catching a quarter of the grid would catch a quarter of your register, and a category holding a quarter of everything has stopped being an escalation signal.
Two cells can hold the same score
Likely with Moderate is 12. Possible with Major is also 12. Same number, same colour, two different problems: one you should expect and can plan around, the other is rarer and far more expensive when it lands. The score ranks them; the cell tells you which kind of treatment has any chance of working.
The three markers on a single risk
The matrix inside a risk's Assessment section is the same grid doing a different job. Rather than counting rows it plots one risk three times, and the legend names each marker.
Take RSK-0007, Backup restoration has never been tested end to end. Its inherent marker sits at 20, deep in the Critical corner. Its residual marker sits at 15, in the High band, because an operating backup control takes some of that away. Its target marker sits at 4, where the owner intends the risk to end up. Three markers, one grid, and the whole treatment argument visible without reading a sentence.
Underneath, a comparison grid puts those three numbers side by side with the gap between them, and adds a line saying what strength of control would reach the target. That line is the useful one: a target of 4 against a residual of 15 is not a plan until something says what would have to be true to get there.
What moves a marker
The inherent marker moves only when you move a stepper, because it is the one pair of ratings you set by hand. The residual marker moves when the controls beneath the risk change: one going from planned to operating, an effectiveness rating revised, a control unlinked. RiskOS records each change in the risk's History, with a chart of the residual score over time, so a marker that has wandered can be traced back to the assessment that moved it.
What the map does not show
A heat map is two dimensions of a risk, and risks have more than two. Onset velocity and detectability sit in the same Assessment section and change neither the score nor the cell, but they change what you should do: a Medium risk that arrives overnight and goes unnoticed often deserves attention ahead of a High one you would watch approaching for months.
Nor does the map show movement, which is what the register's Trend column is for. Indicators are the other half: a measured number on a cadence, with warning and breach thresholds, that moves before anyone re-scores anything. A cell that has looked calm all year while the indicator behind it has been breached since spring is not calm. And when a risk materialises more often than its likelihood implies, RiskOS says so and suggests what the observed frequency would justify.
Troubleshooting
I cannot find the risk a cell is counting
Check whether a filter is still on: the filter icon fills whenever one is active, and a band or over-appetite filter left from an earlier pass will hide rows you are looking for. Search covers title, reference, category, owner, detail and tags, so a fragment of any of those finds the row once the filters are cleared.
Everything is crowded into one corner
That is usually impact inflation rather than a genuinely dire register. If most rows are rated Major or Severe, the scale has stopped separating anything and the map goes flat. Re-rate a handful of the smallest risks first, anchoring each impact point to something concrete, and the rest of the register tends to fall back into shape around them.
A risk moved cells and I do not know why
Two things move a residual marker without anyone touching the risk: a linked control changing status or effectiveness, which re-scores every risk deriving from it, and changing whether controls reduce likelihood, impact or both, which re-scores the whole register at once. Open History to see every assessment with its reason.
The residual marker will not move
Almost always the control is not yet operating. Only controls that are implemented or operating reduce risk; a planned control, however strong it will be, reduces nothing today, and the control's panel says so. Set its status and every risk deriving from it re-scores. A residual score can also never fall below 1, so a marker already at the edge has nowhere left to go.
The markers move too much for me
Turn on Reduce Motion on your Mac. RiskOS removes the gliding movement and keeps every highlight, so markers change cells instantly and nothing about the map's meaning is lost.
Habits that keep the map honest
The map is only as good as the ratings underneath it. A few routines keep both worth looking at.
- Read the residual map, not the inherent one. Inherent tells you how bad the world could be; residual tells you where you stand this morning. Lead every conversation with the second.
- Count before you comment. A single Critical risk with a credible plan is a healthier map than four Highs nobody has looked at since March.
- Check the map against appetite every time. Twelve active risks with an average residual of 9.6 and four sitting over an appetite of 9 is a specific, reportable sentence; "the map looks amber" is not.
- Re-score in one pass. Review walks the risks that are due, worst first, with full context beside the scoring inputs, and the map redraws as you go.
- Export the map with the register behind it. A matrix on its own invites argument; a matrix followed by the top risks and their treatment plans ends it.
Frequently asked questions
What is a risk heat map?
A grid that plots every risk by its likelihood and its impact, colouring each cell by the severity band the score falls into. On a 5×5 scale that gives twenty-five cells running from 1 to 25. RiskOS draws one for the whole register on the Dashboard, and one for each risk in its Assessment section.
What do the colours on a risk matrix mean?
Each colour is a severity band: Low covers 1 to 4, Medium 5 to 9, High 10 to 16 and Critical 17 to 25. The colour tells you which band a cell belongs to and nothing more precise, so two cells sharing a colour can be several points apart. Every band shows a symbol and the written word beside its colour.
Why does a heat map cell show a number?
Because the count is the part the colour cannot carry. One risk in the worst cell and six look identical if you read colour alone, and they call for very different conversations. The number in each cell is how many risks in the register hold that exact pair of likelihood and impact ratings.
Why are some risk scores impossible on a 5×5 matrix?
Multiplying two ratings between 1 and 5 produces only fourteen distinct values: 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20 and 25. Scores such as 7, 11, 13, 14, 17 and 22 have no cell to sit in, which is why the band thresholds are cut around where real scores cluster rather than dividing 25 into four equal parts.
Can I show inherent and residual risk on the same matrix?
Yes. The matrix in a risk's Assessment section plots three markers at once — inherent, residual and target — with a legend naming each. The distance between inherent and residual is what your linked controls are achieving, and the distance from residual to target is what the treatment plan still has to close.
Is a risk heat map readable if I cannot distinguish colours?
Yes. Colour is never the only carrier of meaning in RiskOS. Every band pairs its colour with a symbol and the written word, in the matrix, in the register's badges and in exported reports. VoiceOver reads a whole register row as a single sentence, and Reduce Motion removes marker animation while keeping every highlight intact.
How do I put a risk heat map in a board report?
Open Reports, switch on the risk matrix section along with whatever else the pack needs, and export. The PDF is a paginated, branded document with a running header and footer; the HTML output is one self-contained file that opens in any browser. All four outputs come from a single snapshot, so the matrix and the register always agree.
Does the data behind the heat map leave my Mac?
No. Everything here happens on your Mac. There is no account, nothing is uploaded, and your register never leaves the machine. The map is drawn from the risks already in front of you, and the only time any of it travels anywhere is when you export or back it up yourself.