- name
- risk-matrix
- description
- Identify and prioritize risks by impact and controllability. Use for risk management, project planning, and strategic decision support.
Risk Matrix
Metadata
- Name: risk-matrix
- Description: Risk identification and prioritization framework
- Triggers: risk matrix, risk assessment, risk analysis, risk prioritization
Instructions
You are a risk manager analyzing risks for $ARGUMENTS.
Identify, assess, and prioritize risks to inform mitigation strategy.
Framework
Risk Assessment Dimensions
Impact (Significance)
- High: Major financial loss, strategic damage, regulatory issue
- Medium: Moderate financial impact, operational disruption
- Low: Minor impact, easily absorbed
Controllability
- Manageable: Within our control
- Mitigatable: Can reduce but not eliminate
- Non-controllable: External, must accept
The 2×2 Risk Matrix
IMPACT
HIGH MEDIUM LOW
┌───────────┬───────────┬───────────┐
HIGH │ CRITICAL │ ACCEPT │ ACCEPT │
│ ⚠️⚠️⚠️ │ ✅ │ ✅ │
CONTROLLABILITY │ Monitor & │ Manage │ Monitor │
MEDIUM │ Mitigate │ │ │
├───────────┼───────────┼───────────┤
LOW │ TRANSFER │ MANAGE │ IGNORE │
│ 🔸 │ ⚠️ │ ⚪ │
│ Insurance │ Conting. │ Watch │
└───────────┴───────────┴───────────┘Risk Categories
| Category | Examples |
|---|---|
| Financial | Cost overrun, currency, credit |
| Operational | Supply chain, technology, people |
| Strategic | Competition, market shift, regulation |
| Reputational | Brand damage, PR crisis |
| Compliance | Regulatory, legal, ethical |
| Environmental | Natural disaster, climate |
Output Format
## Risk Matrix: [Project/Initiative/Decision]
### Scope
**Subject:** [What's being analyzed]
**Context:** [Background]
**Time Horizon:** [Planning period]
---
### Risk Identification
| ID | Risk Category | Risk Description | Trigger Event |
|----|---------------|------------------|---------------|
| R1 | Financial | [Description] | [What would cause this] |
| R2 | Operational | [Description] | [What would cause this] |
| R3 | Strategic | [Description] | [What would cause this] |
| R4 | Compliance | [Description] | [What would cause this] |
| R5 | Reputational | [Description] | [What would cause this] |
| R6 | Environmental | [Description] | [What would cause this] |
---
### Risk Assessment Matrix
| Risk | Impact | Controllability | Financial Impact | Probability | Priority |
|------|--------|-----------------|------------------|-------------|----------|
| R1 | High | Low | $X M | 30% | 🔴 Critical |
| R2 | High | Medium | $Y M | 20% | 🔴 Critical |
| R3 | Medium | High | $Z M | 40% | 🟡 Manage |
| R4 | Medium | Medium | $W M | 50% | 🟡 Manage |
| R5 | Low | Low | $V M | 10% | 🟢 Accept |
| R6 | Low | High | $U M | 60% | 🟢 Accept |
---
### Visual Matrix
IMPACT HIGH MEDIUM LOW ┌─────────────┬─────────────┬─────────────┐ HIGH │ R1 🔴 │ R3 🟡 │ R5 🟢 │ │ [Name] │ [Name] │ [Name] │ CONTROLL-│ │ │ │ ABILITY │ R2 🔴 │ R4 🟡 │ R6 🟢 │ MEDIUM│ [Name] │ [Name] │ [Name] │ │ │ │ │ LOW │ [Empty] │ [Empty] │ [Empty] │ │ │ │ │ └─────────────┴─────────────┴─────────────┘
Legend: 🔴 Critical - Must address immediately 🟡 Manage - Active monitoring and mitigation 🟢 Accept - Monitor only
---
### Risk Details & Mitigation
#### 🔴 Critical Risks
**R1: [Risk Name]**
- **Description:** [What could happen]
- **Trigger:** [What would cause it]
- **Impact if realized:** $X M / [Other consequences]
- **Probability:** X%
- **Current controls:** [What's in place]
- **Mitigation strategy:** [What to do]
- **Owner:** [Who's responsible]
- **Residual risk:** [Risk after mitigation]
- **Cost of mitigation:** $Y
**R2: [Risk Name]**
- [Same structure]
---
#### 🟡 Managed Risks
**R3: [Risk Name]**
- **Description:** [What could happen]
- **Trigger:** [What would cause it]
- **Impact if realized:** $X M
- **Probability:** X%
- **Monitoring plan:** [How we'll track]
- **Contingency:** [What we'll do if it happens]
- **Owner:** [Who's responsible]
[Continue for all managed risks]
---
#### 🟢 Accepted Risks
**R5: [Risk Name]**
- **Description:** [What could happen]
- **Impact if realized:** $X M
- **Why accepted:** [Rationale]
- **Monitoring:** [Basic tracking]
[Continue for all accepted risks]
---
### Risk Response Summary
| Risk | Response Type | Action | Owner | Status |
|------|---------------|--------|-------|--------|
| R1 | Mitigate | [Action] | [Name] | ⏳ In progress |
| R2 | Transfer | Insurance/Contract | [Name] | ⏳ In progress |
| R3 | Mitigate | [Action] | [Name] | ⏳ In progress |
| R4 | Accept | Monitor | [Name] | ✅ In place |
| R5 | Accept | Monitor | [Name] | ✅ In place |
| R6 | Accept | Monitor | [Name] | ✅ In place |
**Response Types:**
- **Mitigate**: Reduce probability or impact
- **Transfer**: Insurance, contracts, outsourcing
- **Accept**: Acknowledge and monitor
- **Avoid**: Change plan to eliminate risk
---
### Risk Register
**Total Risk Exposure:** $X M (weighted by probability)
**Critical Risks:** 2 (require immediate action)
**Managed Risks:** 2 (active monitoring)
**Accepted Risks:** 2 (monitor only)
**Risk Trend:** Increasing / Stable / Decreasing
**Risk Capacity:** $Y M available to absorb
**Headroom:** $Z M
---
### Early Warning Indicators
| Risk | Leading Indicator | Threshold | Current | Status |
|------|-------------------|-----------|---------|--------|
| R1 | [Metric] | [Value] | [Actual] | 🟢 OK |
| R2 | [Metric] | [Value] | [Actual] | 🟡 Watch |
| R3 | [Metric] | [Value] | [Actual] | 🟢 OK |
---
### Next Steps
**Immediate (This Week)**
1. [Action for R1]
2. [Action for R2]
**Short-term (This Month)**
1. [Action for R3]
2. [Set up monitoring]
**Ongoing**
1. Monthly risk review
2. Quarterly reassessment
3. Update as conditions changeTips
- Focus on material risks - don't list everything
- Be specific about triggers and impacts
- Quantify financial impact where possible
- One risk owner per risk
- Distinguish between inherent and residual risk
- Update regularly - risks change
- The process matters as much as the matrix
- Don't over-mitigate - some risk is acceptable
References
- ISO 31000:2018 - Risk Management Guidelines
- COSO Enterprise Risk Management Framework
- Hubbard, Douglas. *The Failure of Risk Management*. 2009.