How to use a 5×5 risk matrix on Mac
RiskOS draws the grid for every risk on your Mac. Twenty-five cells, three markers, and a band you can read from the other side of a room.
Twenty-five cells, four bands and three markers. That is the whole of a 5×5 matrix, and it is the picture a risk conversation keeps coming back to. The useful part is not the grid itself but what it lets you see at a glance: how far a risk has travelled since you put controls against it, and how much further it still has to go.
The grid reports; it does not decide. A risk lands in a cell because of the ratings you set in Assessment, so the way to move a marker is to change a rating or change a control — never to pick the cell you would prefer.
Where the matrix lives
Choose Risks in the sidebar, select a row, and open the Assessment section of the panel on the right. Beneath the likelihood and impact steppers sits the matrix, with its legend directly under it. It belongs to the risk you have selected, so it redraws every time you move to another row.
The same grid turns up in a second place. Reports carries a Risk matrix section you can switch on, drawn from the same snapshot as every other section, so the grid and the tables printed beside it can never disagree.
Put a risk on the grid, step by step
-
Open the risk you want to place
Choose Risks in the sidebar and click the row. Open Assessment in the panel and scroll to the grid. Work with a real risk rather than a blank one: a matrix with nothing rated on it teaches you little.
-
Read the legend before the grid
The legend under the matrix names each marker: inherent, residual and target. Read it first. Three markers on twenty-five cells is easy to misread from memory, and the legend is what tells you which of them you are looking at.
-
Set the two inherent ratings
Use the inherent likelihood and impact steppers above the grid. Likelihood runs Rare, Unlikely, Possible, Likely, Almost Certain; impact runs Insignificant, Minor, Moderate, Major, Severe. These are the only two numbers you type into the assessment, and they place the first marker.
-
Watch the marker land in its cell
The inherent marker moves to the cell where your two ratings meet, and the score beside the grid reads that cell's value — likelihood multiplied by impact, somewhere between 1 and 25. Markers glide rather than jump, so you can see which direction a change took the risk.
-
Link the controls and find the second marker
Open Controls in the same panel and link what you actually rely on. With the derive-from-controls toggle switched on, RiskOS works the residual score out from your strongest operating control, and the residual marker separates from the inherent one. The gap between the two markers is your controls, drawn to scale.
-
Place the target marker
Set the target likelihood and impact further down the Assessment section. The third marker appears in the cell you are aiming for, which turns an intention into a position on the same grid as everything else. A target sitting on top of the residual marker is the register telling you there is nothing left to do here.
-
Read the comparison grid underneath
Below the matrix, the comparison grid sets inherent, residual and target side by side with the gap between them, and adds a line telling you what strength of control would close that gap. The matrix says where you are; that line says what it would take to get where you said you were going.
-
Take the grid into a report
Choose Reports, switch on Risk matrix along with whatever else the audience needs, and export. Press ⇧⌘P for a paginated PDF or ⇧⌘E for a single self-contained HTML file. Every output comes from one snapshot, so the grid agrees with the register beside it.
Every score on the grid
A 5×5 matrix has twenty-five cells but only fourteen distinct scores, because multiplication repeats itself. Eleven numbers between 1 and 25 — 7, 11, 13, 14, 17, 18, 19, 21, 22, 23 and 24 — cannot be reached at all. Knowing that saves an argument later, when somebody asks why nothing ever scores 11.
| Likelihood | Insignificant (1) | Minor (2) | Moderate (3) | Major (4) | Severe (5) |
|---|---|---|---|---|---|
| Almost Certain (5) | 5 | 10 | 15 | 20 | 25 |
| Likely (4) | 4 | 8 | 12 | 16 | 20 |
| Possible (3) | 3 | 6 | 9 | 12 | 15 |
| Unlikely (2) | 2 | 4 | 6 | 8 | 10 |
| Rare (1) | 1 | 2 | 3 | 4 | 5 |
Two things follow from the arithmetic. The first is that the grid is not linear: moving impact from Major to Severe costs one point at the bottom row and five points at the top. The second is that the average of all twenty-five cells is exactly 9, the very top of the Medium band — which is why a register whose average residual sits near 9 is unremarkable rather than reassuring.
Which cells each band takes
Bands are cuts across the same twenty-five cells. They are what colours a cell, fills a badge and leads a report, and they are deliberately uneven: the cut between High and Critical is placed so that only the corner of the grid reaches the top band.
| Band | Score | Cells | Where they sit |
|---|---|---|---|
| Low | 1–4 | 8 of 25 | The corner where rare meets insignificant. |
| Medium | 5–9 | 7 of 25 | The band running diagonally through the middle. |
| High | 10–16 | 7 of 25 | The arc between the middle and the corner. |
| Critical | 17–25 | 3 of 25 | Only 20, 20 and 25 — the corner itself. |
Three cells out of twenty-five is the point of the design. A top band that catches a quarter of the register stops being an escalation and starts being a mood.
The colours are never carrying the meaning on their own. Every band pairs its colour with a symbol and the written word, in the grid legend as much as in the table and the report, so the same information reaches somebody who cannot separate two of the colours.
The three markers
The markers are the reason the grid is worth looking at. One number tells you where a risk is; the three RiskOS draws tell you where it came from, where it stands, and where you have committed to take it.
| Marker | What it shows | What moves it |
|---|---|---|
| Inherent | The exposure with nothing standing in its way. | The inherent likelihood and impact steppers. |
| Residual | Where the risk stands once controls are taken into account. | Linking a control, or a control's status or effectiveness changing. |
| Target | The position you intend to reach. | The target likelihood and impact steppers. |
Reading the distance between markers
A short hop from inherent to residual means the controls you have linked are not doing much yet, whatever the plan says. A long one that stops well short of the target means the treatment is working and is not finished. Two markers in the same cell means the register has not been told about a single operating control — which is either honest or an oversight, and worth knowing which.
Why the residual marker can never overtake the inherent one
Residual can never exceed inherent, never falls below 1, and a stronger control never raises a score. Those three rules hold no matter what you link or how you rate it, which is what lets you read the distance between the markers as progress rather than as noise. If the residual marker is not where you expect, the answer is always in the controls or the ratings, never in the arithmetic.
What the grid does not show
Onset velocity and detectability do not move a marker, because they change how much warning you would get rather than how big the risk is. A Moderate risk that arrives overnight and goes unnoticed can deserve attention ahead of a High one you would see coming for a quarter. The grid is the first question you ask about a risk, not the last.
When the whole grid moves
Three settings change what the matrix does, and each of them changes it everywhere at once rather than one risk at a time. Two live in Methodology and the third is your appetite.
The direction controls push in
In Settings ▸ Methodology you choose whether controls reduce likelihood, impact or both. That choice decides the direction the residual marker travels away from the inherent one: towards rarer, towards less severe, or diagonally towards both. Change it and RiskOS re-scores every risk in the register immediately, so no row is left sitting under the old rule.
The band thresholds themselves
The same section holds the scales and the band thresholds. They are the cuts described above, shown rather than hidden, so a number on a report can always be traced back to the rule that produced it.
Appetite drawn across the grid
Appetite is the highest residual score you tolerate, and it works like a line across the grid: anything beyond it is flagged wherever it appears, in the table, on the panel header and in the report. A category can hold its own threshold with a rationale, and an individual risk can override both, so two risks in the same cell can quite correctly be treated differently.
Troubleshooting
The residual marker is sitting on top of the inherent one
Nothing is reducing the risk yet. Either no control is linked, or the ones that are linked are still planned. Only controls that are implemented or operating reduce risk, so a planned control — however strong it will be — leaves the two markers in the same cell. Open the control, set its status, and every risk deriving from it re-scores.
The marker moved sideways when I expected it to drop
Your methodology is reducing one dimension rather than the other. Settings ▸ Methodology decides whether controls act on likelihood, on impact or on both, and the marker travels accordingly. Nothing is wrong with the score; it is moving along the axis you asked for.
I cannot tell which marker is which
Use the legend under the grid rather than the colours. Each marker is named there, and every band badge carries a symbol and a word alongside its colour. With Reduce Motion switched on, markers move without the glide, which can make a change harder to spot; the comparison grid underneath states the same three values in words.
A lower-scoring risk is flagged and a higher one is not
Appetite is resolved in order: the risk's own override first, then its category's threshold, then the organisation's, then none at all. A risk in the Compliance & Regulatory category may be held to a tighter threshold than an operational one, so it can be flagged at a lower score. Open Appetite in the panel and the threshold it inherited is explained there.
The matrix is missing from my report
Its section toggle is off. Choose Reports, switch on Risk matrix, and export again. The matrix is one of ten sections you choose from, so it stays off until you ask for it.
Habits that keep the grid honest
The grid rewards a few small disciplines, and punishes their absence quietly for months before anyone notices.
- Rate the exposure, not the cell. Deciding where a risk ought to sit and then choosing ratings that put it there is the fastest way to a register nobody can defend.
- Watch the distance, not the position. A Critical risk with a closing gap and a dated plan is in better shape than a Medium one that has not moved since March.
- Keep the top corner small. Three cells reach Critical. If a tenth of your register is up there, re-read the impact scale before you re-read the risks.
- Set a target on everything above appetite. Without the third marker the grid shows a problem and no intention, and the comparison grid has nothing to measure the gap against.
- Let a control's status do the work. Moving a control from planned to operating is what moves residual markers across the whole register, and it takes seconds.
- Re-score in one pass. Review brings the risks that are due one at a time, worst first, with the projected rating updating before anything is written.
- Send the grid with the numbers. A matrix on its own invites interpretation; a matrix beside the top risks and the open actions answers the questions it raises.
Frequently asked questions
What is a 5×5 risk matrix?
A grid of twenty-five cells formed by rating likelihood from 1 to 5 and impact from 1 to 5. Each cell holds the product of the two, giving a score from 1 to 25, and each score falls into a band. RiskOS draws the grid on every risk and places markers for inherent, residual and target ratings.
How many cells on a 5×5 matrix are Critical?
Three. Critical covers 17 to 25, and only three cells reach it: Likely with Severe impact, Almost Certain with Major impact, and Almost Certain with Severe impact, scoring 20, 20 and 25. Low takes eight cells, Medium seven and High seven, which is what keeps the top band meaningful.
Why can a risk never score 7, 11 or 13?
Because every score is one number from 1 to 5 multiplied by another. Eleven values in the range — 7, 11, 13, 14, 17, 18, 19, 21, 22, 23 and 24 — are not products of two numbers in that range, so no combination of ratings produces them. Fourteen distinct scores cover all twenty-five cells.
What do the three markers on the risk matrix mean?
Inherent is the exposure before controls, residual is where the risk stands once linked controls are taken into account, and target is the position you intend to reach. The legend under the grid names each one. The distance between inherent and residual is what your controls are actually achieving.
Does changing my methodology change the matrix?
Yes. Settings ▸ Methodology holds the scales, the band thresholds and the choice of whether controls reduce likelihood, impact or both. That last choice decides the direction residual markers travel, and changing it re-scores every risk in the register at once rather than leaving old ratings in place.
Can I put a risk matrix in a report?
Yes. Reports carries a Risk matrix section toggle alongside the executive summary, top risks, full register, controls, open actions and framework coverage. Every output — PDF, HTML, Excel and print — is built from the same snapshot, so the matrix always agrees with the tables printed beside it.
How do I read the matrix if I cannot tell the colours apart?
Colour is never the only carrier of state. Every band shows its colour with a symbol and the written word together, the legend names each marker, and the comparison grid below states inherent, residual, target and the gap as numbers. VoiceOver reads a register row as one sentence rather than a string of cells.
Does anything on my risk matrix leave my Mac?
No. Everything here happens on your Mac. There is no account, nothing is uploaded, and your register never leaves the machine. It travels only when you export or back it up yourself, to a location you choose. The one network RiskOS uses is Apple's App Store, for purchases, and it never sees your register.