HKSM

A probability and impact matrix is a grid that compares a risk’s likelihood against its potential effect on project objectives to assign a priority rating. It standardizes qualitative risk analysis and guides where to focus responses.

Key Points

• Maps probability levels against impact levels to produce a risk rating (for example, High, Medium, Low).
• Uses clear, calibrated definitions so different team members assess risks consistently.
• Often includes color-coding and thresholds aligned with organizational risk appetite and tolerance.
• Can be set up separately for threats (negative impact) and opportunities (positive impact), or handled with mirrored scales.
• Supports prioritization of the risk register and selection of appropriate response strategies.
• Should be baselined in the risk management plan and controlled through change management.
• Works best when validated with historical data and reviewed at phase gates or major changes.

Purpose

The matrix provides a consistent, transparent way to prioritize risks and decide where to invest time and budget. It helps the team communicate risk exposure, set escalation criteria, and align analyses with stakeholder risk appetite.

Field Definitions

• Probability scale: Ordered levels with descriptive anchors and optional numeric ranges (for example, Very Low 0.05, Low 0.1–0.3, Medium 0.31–0.5, High 0.51–0.7, Very High 0.71–0.9).
• Impact scale: Ordered levels with criteria tied to project objectives (for example, Minor, Moderate, Major, Severe; defined for cost, schedule, scope, or quality).
• Scoring method: How probability and impact combine (for example, multiplication, lookup grid, or rules).
• Rating categories: Mapping of scores to ratings (for example, High/Medium/Low) and associated colors.
• Thresholds and escalation: Boundaries that trigger action, reporting, or governance reviews.
• Cell guidance (optional): Recommended responses per rating (for example, High-threat = escalate/mitigate, High-opportunity = exploit/enhance).
• Version, owner, effective date: Governance metadata to track and control updates.

How to Create

• Engage stakeholders to understand risk appetite, tolerance, and decision criteria.
• Select probability and impact levels (typically 3–5 each) and draft clear definitions with measurable anchors.
• Choose a scoring approach (for example, P x I) and define rating bands and colors consistent with governance.
• Calibrate each level using historical data, expert judgment, and example scenarios.
• Decide whether to use separate matrices for threats and opportunities or a single mirrored matrix.
• Document thresholds, escalation rules, and any cell-specific guidance.
• Review with the team, obtain approval, baseline in the risk management plan, and store in a shared repository.

How to Use

• For each identified risk, assess probability and impact using the matrix’s definitions and record the rating in the risk register.
• Prioritize risks by rating, then allocate analysis and response planning effort to higher-priority items.
• Align response strategy to rating and type: avoid/mitigate/transfer/accept for threats; exploit/enhance/share/accept for opportunities.
• Apply thresholds to trigger escalation, additional analysis (for example, quantitative), or contingency planning.
• Reassess risks periodically and after major changes; update ratings and responses accordingly.
• Use the matrix in workshops to drive consistent judgments and communicate status to stakeholders.

Ownership & Update Cadence

• Owner: Project manager or risk manager; approval by sponsor or governance body per the risk management plan.
• Cadence: Baseline during planning; review at phase gates, major scope or context changes, or on a regular cycle (for example, monthly).
• Control: Manage changes through configuration control; keep version history and effective dates.
• Communication: Publish updates to the team and refresh training or guidance when definitions change.

Example Rows

• Probability scale: Very Low (≤0.1), Low (0.11–0.3), Medium (0.31–0.5), High (0.51–0.7), Very High (≥0.71).
• Impact scale - cost: Minor (≤2% overrun), Moderate (2–5% overrun), Major (5–10% overrun), Severe (>10% overrun).
• Impact scale - schedule: Minor (≤5 days), Moderate (6–15 days), Major (16–30 days), Severe (>30 days).
• Score-to-rating: P x I < 0.5 = Low (Green); 0.5–1.5 = Medium (Yellow); >1.5 = High (Red).
• Threat example: P = 0.6 (High), I = Major (3) ⇒ Score = 1.8 ⇒ Rating = High (Red) ⇒ Escalate and plan mitigation.
• Opportunity example: P = 0.4 (Medium), I = Moderate benefit (2) ⇒ Score = 0.8 ⇒ Rating = Medium (Blue) ⇒ Plan to enhance.

PMP Example Question

The team’s risk ratings are inconsistent across workshops. What should the project manager do first to improve consistency when using the probability and impact matrix?

1. Increase the number of rating categories from three to five.
2. Conduct a lessons learned session after all risk responses are completed.
3. Refine and calibrate the matrix’s probability and impact definitions with stakeholders.
4. Switch from qualitative to quantitative risk analysis for all risks.

Correct Answer: C — Refine and calibrate the matrix’s probability and impact definitions with stakeholders.

Explanation: Clear, agreed definitions are essential for consistent qualitative assessments. Calibration with stakeholders reduces variation and improves reliability of ratings.