Risk heat map
Also called likelihood and impact matrix, risk matrix
A risk heat map is a grid that plots risks by likelihood on one axis and impact on the other, with cells coloured from green to red. It shows at a glance which risks are most severe. Firms use heat maps in risk registers, risk and control self-assessments and board risk reports.
How it works
The firm defines scales for each axis, usually four or five levels. Impact scales set thresholds in money, customer harm, regulatory or reputational terms, and likelihood scales set probabilities or frequencies over a period. Each risk is scored on both scales, often first as inherent risk before controls and then as residual risk after controls, and placed in the matching cell.
The colours link to risk appetite: red cells need action or escalation, amber cells need monitoring and green cells sit within appetite. Showing inherent and residual positions together shows how much controls reduce each risk. Heat maps compress judgement into a few categories, so firms back them with the underlying scores, key risk indicators and loss data, and calibrate scales so business units score consistently.
The rules
Describes the consequence and likelihood matrix as a risk assessment technique, including how to design scales and its limitations.
Any organisation, voluntary standardSets out the risk management process of identifying, analysing and evaluating risks against criteria, which heat maps are used to present.
Any organisation, voluntary standardCommon questions
What is the difference between a heat map and a risk register?
A risk register is the full list of risks with owners, controls, scores and actions. A heat map is a visual summary that plots the register's risks by likelihood and impact.
Should a heat map show inherent or residual risk?
Many firms show both. Inherent risk shows exposure before controls; residual risk shows what remains after them. The gap between the two shows how much the firm relies on its controls.
Do regulators require heat maps?
No law requires a heat map. Regulators expect firms to assess and report risks against their risk appetite, and heat maps are a common way to present that to boards.
