Assessing risks: likelihood and impact · RiskAtoms Academy

By the end you will be able to

1Score risks on a likelihood and impact matrix, using defined scales.
2Build a heat map and rank risks by their scores.
3Explain where the heat map misleads: ordinal scores multiplied as numbers, ranges that hide tails, and the same expected loss from very different risks.
4Compare a score with an expected loss in money.

Why it matters

Larkfield's heat map puts card fraud at the top and a cyber attack near the bottom. On average, both cost the bank the same each year. Only one of them could cost €150m in a single year.

Core explanation

Two questions for every risk

Once risks are found (L2.4.02: Identifying risks), the firm needs to know which matter most. Assessment asks two questions of each one: how likely is it, and how big would its impact be? Each answer is a band from 1 to 5, and the two are plotted on a risk matrix. Coloured green to red, it is called a heat map, and it is on the wall of nearly every risk function.

Define the words first. “Likely” means different things to different people. So each band is pinned to a number: a chance per year for likelihood (see M-C01: Probability basics), and an amount of money for impact. These are Larkfield's:

Likelihood: chance in the next 12 months

1Rareunder 5%
2Unlikely5% to 20%
3Possible20% to 50%
4Likely50% to 80%
5Almost certainover 80%

Impact: loss if it happens

1Minorunder €1m
2Moderate€1m to €5m
3Major€5m to €20m
4Severe€20m to €100m
5Criticalover €100m

The score is likelihood × impact, from 1 to 25. Larkfield rates 1 to 4 low, 5 to 10 medium and 12 to 25 high. Now build its heat map from the eight risks on its register.

Build itLarkfield's heat map

Pick a risk, then click its cell (or drag it there on a computer). Use the scales above.

Likelihood →

1 Minor2 Moderate3 Major4 Severe5 Critical

Impact →

Low: score 1 to 4Medium: 5 to 10High: 12 to 25

Where the heat map misleads

A heat map is quick and easy to discuss, which is why everyone uses it. It also hides three things.

1. Ranks multiplied as if they were amounts. The bands are an ordinal scale: they only put risks in order. In money, impact band 4 (€20m to €100m) is about twenty times band 2 (€1m to €5m), not twice. So the product of two bands means little. Manual payment errors (4 × 2) and consumer loan losses above plan (2 × 4) both score 8, yet their expected losses are €1.05m and €6.0m a year: 5.7 times apart.

2. Ranges hide tails. Every cell is a range. A risk with a 21% chance of €5.1m and one with 49% of €19.9m sit in the same cell (3, 3), but one has 9.1 times the expected loss of the other. Worse, a real risk is rarely one outcome. A cyber attack might be a small incident or a disaster: which one do you plot? Plot the likely one and you hide the tail; plot the worst one and you hide how often the small ones happen.

3. The same expected loss from very different risks. Card and app fraud costs about €3m every year. A cyber attack and data breach has a 2% chance of costing €150m. Both have an expected loss of €3m a year (M-C02: Expectation). The first can go in the budget. The second could cost 50 times as much in one bad year, and needs capital, insurance and a recovery plan. The heat map scores the first 10 and the second 5: the predictable risk looks worse.

So what is a heat map for?

Use it to sort a long list quickly and to start a conversation. For the risks near the top, and for any risk with a severe worst case, go further: measure the expected loss in money and look at the tail. M2.5: First risk measures gives you the tools.

The formal version

Two formulas sit behind this lesson. The first is the matrix score, which is just a product of two band numbers:

\text{Score} = \text{likelihood band} \times \text{impact band}, \qquad \text{each band } 1, 2, \dots, 5

The second is the expected loss. If an event happens with probability $p$ in a year and costs $L$ when it does, the loss is $L$ with probability $p$ and 0 otherwise, so

E[\text{loss}] = p \times L + (1 - p) \times 0 = p \times L

When a risk has several possible outcomes $k = 1, \dots, n$ , each with its own chance $p_k$ and loss $L_k$ , add them up:

E[\text{loss}] = \sum_{k=1}^{n} p_k L_k = p_1 L_1 + p_2 L_2 + \dots + p_n L_n

Shown in full, without an animation: this is the expectation you met in M-C02: Expectation, applied to losses. The outcomes must not overlap, so their chances add up to at most 1.

Try it

Set two risks side by side. Start with the first preset: same score, different money. Then try to make the matrix and the money disagree about which risk is bigger.

Try itScore against money

Try:

Risk A

Chance in a year70%

Loss if it happens€1.5m

Likelihood: 4 Likely
Impact: 2 Moderate
Score: 8 Medium
Expected loss: €1.05m

Risk B

Chance in a year15%

Loss if it happens€40m

Likelihood: 2 Unlikely
Impact: 4 Severe
Score: 8 Medium
Expected loss: €6.00m

Likelihood →

5

10

15

20

25

4

8

12

16

20

3

6

9

12

15

2

4

6

8

10

1

2

3

4

5

1 Minor2 Moderate3 Major4 Severe5 Critical

Impact →

Same score (8), yet B's expected loss is 5.7 times the other's.

Worked example

Scoring cyber risk at Larkfield

Larkfield's security team describes three outcomes for the next year. Work out the score and the expected loss before you open each step.

Outcome	Chance in a year	Loss if it happens
Minor incident, contained in hours	25%	€0.4m
Serious breach of some customer data	5%	€12m
Severe attack: data stolen, systems locked	2%	€150m

Three outcomes, one risk

Step 1 of 5

1
Score each outcome on its own
Minor: band 3 × band 1 = 3 (low). Serious: 2 × 3 = 6. Severe: 1 × 5 = 5. Which one goes on the heat map? The workshop picks the severe one, so cyber shows as medium, score 5.

Regulatory lens

No rule prescribes a 5 × 5 matrix. ISO 31000 says risk analysis can be qualitative, quantitative or both, and its companion IEC 31010 lists the likelihood and consequence matrix as one technique among many, with its limits. The Basel Committee's operational risk principles expect banks to assess risks against consistent criteria linked to their risk appetite.

Capital is a different matter: regulators do not set capital from heat map scores. Banks' capital for operational risk comes from their size and loss history, and insurers' from a 1-in-200-year loss under Solvency II. Those calculations come in Level 4: Regulation, Capital & Accounting.

Sparks

SparkWhat does 'serious possibility' mean?

In 1964 Sherman Kent of the CIA wrote “Words of Estimative Probability”, after finding that colleagues who had all agreed a report's phrase “a serious possibility” read it as anything from about a 20% chance to an 80% chance. He proposed pinning each phrase to a range of probabilities, which is exactly what a likelihood scale does.

SparkWorse than useless?

In 2008 the risk analyst Tony Cox published “What's wrong with risk matrices?” in Risk Analysis. He showed that matrices can give a higher rating to a risk that is smaller in expected loss, and that in some cases they do worse than choosing at random. His advice was not to throw them away, but to use them with care.

Key takeaways

Assessment scores each risk for likelihood and impact on defined scales, and plots it on a heat map.
Pin every band to a number (a chance per year, an amount of money) so that 'likely' means the same to everyone.
Scores are ordinal: multiplying them treats ranks as amounts, so equal scores can hide very different losses.
A cell is a range, and a risk is rarely one outcome: the heat map hides the tail.
Expected loss (chance × loss, added over outcomes) puts risks in money, but equal averages can hide very different worst cases.
Use the heat map to sort and discuss; measure the top risks in money and look at their tails.

Reaction

Check what stuck

Question 1 · objective 1

On Larkfield's scales, a risk has a 10% chance in a year of costing €30m. What is its score (likelihood × impact)?

Question 2 · objective 4

What is that risk's expected loss for the year, in € millions?

€m

Question 3 · objective 3

Why is multiplying a likelihood band by an impact band risky?

ABecause multiplication is harder than additionBBecause the bands are only an order, not amounts: band 4 impact is about twenty times band 2 in money, not twiceCBecause likelihood should always be divided by impactDBecause scores above 10 are not allowed

Question 4 · objective 4

Cyber risk has three outcomes in a year: 25% chance of €0.4m, 5% of €12m and 2% of €150m. What is the expected loss, in € millions?

€m

Question 5 · objective 3

Card fraud (€3m almost every year) and a cyber attack (2% chance of €150m) both have an expected loss of €3m. Which needs a plan for one very bad year?

ACard fraud, because it has the higher heat map scoreBNeither: equal expected losses mean equal riskCThe cyber attack, because its loss in a bad year is 50 times largerDBoth equally

Glossary

Likelihood: How probable a risk event is over a set period, here the next 12 months.
Impact: How much harm the event would do if it happened, here measured as a loss in euros.
Risk matrix: A grid with likelihood on one axis and impact on the other, used to score and rank risks.
Heat map: A risk matrix coloured from green to red, with each risk plotted in its cell.
Ordinal scale: A scale whose numbers only give an order (1st, 2nd, 3rd), not a size. Band 4 is above band 2, not twice it.
Expected loss: The probability-weighted average loss: each possible loss times its chance, added up.
Tail: The rare, very large losses at the far end of the range of outcomes.

Deep Dives & Origins

Deep Dives

Hubbard, D. W., The Failure of Risk Management: Why It's Broken and How to Fix It, 2nd edition, Wiley, 2020. Beginner.
Cox, L. A., “What's wrong with risk matrices?”, Risk Analysis, 28(2), 2008, pp. 497–512. Advanced.

Origins

International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines, clause 6.4.3 (risk analysis).
IEC 31010:2019, Risk management: Risk assessment techniques, IEC and ISO, 2019.
Kent, S., “Words of Estimative Probability”, Studies in Intelligence, CIA, 1964.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.