Probability and Impact Matrix

A two-axis chart that places each identified risk based on how likely it is to happen and how much it would affect project objectives if it occurs, allowing risks to be compared and prioritized.

Key Points

  • Plots probability on one axis and impact on the other to visualize risk severity.
  • Used in qualitative risk analysis to categorize and rank risks for response planning.
  • Often uses defined scales (e.g., Low/Medium/High or 1–5) with thresholds and color coding.
  • Customized to organizational risk criteria and helps decide which risks to escalate, treat, monitor, or accept.

Example

The project team lists 30 risks, rates each for likelihood and consequence on a 1–5 scale, and plots them in a 5x5 matrix. Items in the High-High area are prioritized for immediate response planning, Medium items are monitored with triggers, and Low items are placed on a watch list.

PMP Example Question

During qualitative risk analysis, the team uses a 5x5 table that maps likelihood on one axis and consequence on the other to categorize and prioritize risks. What tool are they using?

  1. Probability and Impact Matrix
  2. Risk Breakdown Structure
  3. Risk Register
  4. Sensitivity Analysis (Tornado diagram)

Correct Answer: A — Probability and Impact Matrix

Explanation: The probability and impact matrix maps the likelihood of each risk against its potential effect on project objectives to prioritize response actions.

ICS/OT Cybersecurity Fundamentals — Security Built for Industrial Systems

Industrial control systems cannot be secured like ordinary IT. A forced reboot, aggressive scan, or incompatible patch can interrupt production and create real safety consequences. Effective OT security begins with understanding the systems, constraints, and risks unique to industrial environments.

This course gives IT professionals, engineers, operators, and security practitioners a practical foundation in ICS threats, zone and conduit design, risk assessment, passive asset visibility, and vendor evaluation. You will learn how IEC 62443, NIST CSF, and MITRE ATT&CK for ICS apply where availability and safety come first.

Eight reconstructed incidents—including Stuxnet, Triton, Ukraine 2015, Colonial Pipeline, and PIPEDREAM—show how attackers move through OT environments, what they target, and which defenses could have changed the outcome.

Watch the course preview, then build the vocabulary, frameworks, and judgment needed to take credible first steps in ICS/OT cybersecurity.

Explore the Course


ICS/OT Cybersecurity Fundamentals course preview

Advance your Lean Six Sigma expertise!

HK School of Management and Technology helps you take Lean Six Sigma to the next level without the overwhelm. Master advanced statistical tools, Excel-based analysis, and real-world improvement techniques to solve complex problems with confidence. Practical skills, tools, and guidance you can apply right away. Covered by Udemy's 30-day refund policy.

Learn More