The composite risk index and the 5×5 risk matrix

The composite risk index and 5×5 matrix provide a compact way to compare risks by combining their likelihood and consequence.

When to use it

• Use the index to prioritise risks in strategy, projects, operations, safety, healthcare and governance.
• Apply the same structure to financial, information-security, reputational and safeguarding concerns, not only obvious physical hazards.
• For each material risk, select one of the 4Ts: terminate, transfer, treat or tolerate.

Origins

The 5×5 likelihood–consequence matrix is a modern form of risk-assessment methods used across twentieth-century engineering, military safety and project management. No single inventor owns this version; organisations and standards converged on ordinal categories that are easy to display. Multiplying ratings produces a ranking aid, not a measured probability or expected loss, because labels such as ‘unlikely’ and ‘likely’ are not interval-scale quantities.

What it is

Risk tools can become visually dense and focus only on threats rather than opportunities. The matrix’s advantage is rapid communication: it makes the organisation’s current judgements visible and gives leaders a common basis for discussing priorities. Its simplicity must be balanced with context about uncertainty, velocity, control effectiveness and exposure.

How to use it

Assemble the principal market, competitive, strategic and operational risks identified during strategy development. Define the scoring criteria before rating anything.

For likelihood, move from rare, through unlikely, possible and probable, to almost certain. For impact, move from negligible, through minor, moderate and major, to severe. Assign each category a grade and combine the two grades to form the composite index.