Create a risk matrix: Excel template and worked example
Build an information-security risk matrix. Free Excel template with dynamic matrices, a risk register and initial and residual risk examples.
Which security risks need a measure first? A risk matrix helps compare assessments by likelihood and impact. Your team needs understandable scales and a shared basis for those ratings.
Download the risk matrix Excel template – no registration required. It includes a blank register for 20 risks, two automatically updated 5×5 matrices, a worked example and instructions. You can edit thresholds and record measures, owners and deadlines.
What a risk matrix tells you
The matrix combines likelihood and impact. A likely scenario with severe consequences usually needs more attention than a rare, limited disruption. The classification supports discussions about treatment and priorities.
This workbook uses a simple qualitative method: both factors receive values from 1 to 5, and the score is their product. The result is not expected monetary loss or an exact statistical measurement. Neither a 5×5 layout nor these colour thresholds is a universal ISO 27001 requirement.
1. Describe the scenario
“Cloud risk” is too broad. Describe the event, the affected process and the consequences. For example: “The document service becomes unavailable, preventing the support team from handling customer cases.”
Record existing controls and the reasoning behind the rating. A tested recovery procedure can change the assessment. A merely planned backup cannot yet do so.
2. Rate likelihood and impact
Agree the assessment period and what each level means for your organisation. The instructions offer these qualitative starting points:
| Level | Likelihood | Impact |
|---|---|---|
| 1 | Rare | Limited operational disruption |
| 2 | Unlikely | Local, short-lived impairment |
| 3 | Possible | Material impairment |
| 4 | Likely | Severe impairment of a core service |
| 5 | Very likely | Critical or sustained harm |
Add organisational criteria such as tolerable downtime, sensitive data, financial consequences or affected customer services. Record why you selected each level. Without shared definitions, two people may assess the same scenario differently.
3. Calculate scores and set thresholds
Risk score = likelihood × impact
Scores range from 1 to 25. The editable example bands are 1–5 low, 6–14 moderate, and 15–25 high. Change the thresholds on the Guide sheet; categories and matrix colours follow those settings. The high threshold must exceed the moderate threshold. Invalid settings produce “Check inputs” in the category.
Each matrix cell displays category · count / risk score. “High · 1 / 20” means one assessed risk occupies that position, which has a score of 20. It is not a percentage or a sum of losses. Missing or invalid factors do not generate a plausibly low risk score.
4. Separate initial and residual risk
Initial risk in this workbook describes the current situation, including existing controls. It does not automatically mean inherent risk with all safeguards removed.
Record an additional measure, an owner, a deadline and its implementation status. The workbook calculates residual risk only when the status is Implemented and both new factors are complete. You may prepare proposed factors earlier, but they do not yet appear in the residual matrix.
A status label alone does not establish effectiveness. Check the measure before recording a lower likelihood or impact, and document the evidence in the rating rationale.
Example: three information-security risks
The example sheet uses fictional data:
| Scenario | Initial score | Measure | Residual assessment |
|---|---|---|---|
| Document service outage | 3 × 4 = 12 | Test restore and alternative access | Pending: measure is planned |
| Unauthorised privileged access | 4 × 5 = 20 | MFA and restricted admin roles | 2 × 4 = 8, after implementation |
| Accidental deletion causes data loss | 2 × 4 = 8 | Retention and tested restore | 1 × 3 = 3, after implementation |
The first risk remains in the initial matrix despite prepared new factors. The two implemented measures receive updated assessments in the residual matrix. This keeps planned improvements separate from current safeguards.
5. Record the decision and next review
A category does not decide whether a risk is acceptable. Establish who makes that decision, under which conditions, and when it will be reviewed. A moderate risk may still be unacceptable for a particular process.
The workbook connects assessment with treatment. Across several teams, keeping tasks, evidence and review dates current becomes harder. Risk management in Kopexa connects risks with follow-up work. For service-provider dependencies, third-party risk management adds the vendor context.
Frequently asked questions
Is the matrix a complete risk assessment?
No. It visualises assessment results. Scenarios, controls, rating rationale and decisions still need traceable documentation.
What happens when a rating is missing?
The row shows “Missing rating”. It is not assigned zero or a low category and does not count as an assessed risk in the matrix. The incomplete-initial-ratings count makes these rows visible.
Can I add more than 20 risks?
Copy rows with their formulas and validation. Then extend the ranges for both matrices and summaries. The instructions state this limit; the workbook does not promise automatic range expansion.
Quellen
- NIST SP 800-30 Rev. 1 [Abgerufen am ]