← All tools
Delivery
Project Risk Matrix
The risks that aren't written down are the ones that show up in crisis meetings. I built this tool to get project risks out of people's heads and onto a grid everyone can read and act on.
Add a risk
UnlikelyNear-certain
NegligibleCritical
Score:9 — Medium
No risks added yet. Enter the first risk identified on your project.
No data is stored — everything runs in your browser.
How to use this tool
- 1Add each identified risk with a description
- 2Rate the probability (1 to 5) and impact (1 to 5)
- 3Add a mitigation action for high-severity risks
- 4Review the heatmap and register sorted by criticality
Why it matters
An unrecorded risk is one you discover in a crisis meeting. The probability × impact matrix helps prioritise mitigation effort: not all risks deserve the same treatment. Critical risks (score 15-25) demand an immediate action plan; low risks can simply be monitored. A register visible to the whole team also prevents alerts from living only in one person's head.
Frequently asked questions
- How do you rate probability and impact?
- Probability: 1 = near-impossible, 3 = possible, 5 = near-certain. Impact: 1 = negligible for the project, 3 = significant disruption, 5 = threatens the entire project. Calibrate these ratings as a team so they mean the same thing to everyone.
- What is the difference between a risk, an issue, and an assumption?
- A risk is a future uncertain event that could negatively impact the project. An issue is a risk that has materialised. An assumption is a condition assumed to be true on which the plan relies: if it proves false, it becomes a risk. The matrix handles risks; issues go into the backlog.
- How often should the risk register be updated?
- At minimum at the start of each sprint or phase. Ideally, any new information about the project (workshop outcome, supplier feedback, client decision) should trigger a reassessment of affected risks.