Risk Heat Map: What It Is, How to Build One, and Its Limits
Maxim Atanassov •
A risk heat map is a grid that plots each risk by its likelihood and its impact, coloured from green (low) to red (high), so a board can see at a glance which risks need attention first. Likelihood runs along one axis, impact along the other. Each cell's colour comes from combining the two. It is the most common picture in enterprise risk management, and one of the most misused.
A 5x5 risk heat map example
The example below scores likelihood and impact from 1 to 5. Each cell shows the score (likelihood times impact) and its colour band. The risks placed on it are illustrative.
| Impact ↓ / Likelihood → | 1 Rare | 2 Unlikely | 3 Possible | 4 Likely | 5 Almost certain |
|---|---|---|---|---|---|
| 5 Severe | 5 Amber | 10 Red | 15 Red | 20 Red: cyber breach | 25 Red |
| 4 Major | 4 Green | 8 Amber | 12 Red: key supplier failure | 16 Red | 20 Red |
| 3 Moderate | 3 Green | 6 Amber | 9 Amber: revenue recognition error | 12 Red | 15 Red |
| 2 Minor | 2 Green | 4 Green | 6 Amber | 8 Amber: staff turnover | 10 Red |
| 1 Negligible | 1 Green | 2 Green | 3 Green | 4 Green | 5 Amber |
Bands used here: 1 to 4 green, 5 to 9 amber, 10 and above red. Your bands should come from your risk appetite, not from this table.
How to build a risk heat map in six steps
1. Define the scales in writing
Give each likelihood level a probability range over a set period (for example, "Likely: 50% to 80% within 12 months"). Give each impact level a measure the business uses: dollars of earnings, days of outage, number of people hurt, regulatory action. Without written scales, two managers will rate the same risk two ways.
2. Set the colour bands from your risk appetite
Decide which scores the board will tolerate (green), which need management action (amber) and which need board attention (red). Write the bands down. See our guide to risk appetite.
3. Take the risks from the risk register
Plot the principal risks, not every risk. Ten to twenty dots is readable; eighty is not.
4. Rate each risk with the people who own it
Run a workshop with the risk owners and challenge each rating against data: incidents, losses, audit findings, industry events. Our guide to leading risk management workshops covers how.
5. Plot inherent and residual risk
Inherent risk is the rating before controls; residual risk is the rating after them. Showing both, with an arrow between them, tells the board how much the controls are doing.
6. Review and refresh
Update the map each quarter or when a principal risk changes. Show movement since the last report, because a board reads change faster than position.
How to read a heat map
- Top right: likely and severe. These risks need an owner, a plan and board attention now.
- Top left: rare but severe. Do not dismiss these because the cell is amber. Pandemics, major cyber attacks and fraud live here, and they call for resilience planning more than prevention.
- Bottom right: frequent but minor. Handle these with process and controls; do not spend board time on them.
- Bottom left: accept and monitor.
The limits of risk heat maps
A heat map is a communication tool, not a measurement tool. The research is blunt about it.
- Range compression. Louis Anthony Cox showed in "What's Wrong with Risk Matrices?" (Risk Analysis, 2008) that a matrix can give the same colour to risks that differ greatly in size, and can even rank a smaller risk above a larger one.
- False precision. Multiplying two ordinal scores (a 3 and a 4) produces a number that looks exact and is not. A score of 12 is not twice as bad as a score of 6.
- Inconsistent ratings. Different people, given the same facts, place the same risk in different cells.
- Missing correlation. A heat map shows risks one by one. It cannot show that a supplier failure and a cyber breach might happen together.
Douglas Hubbard makes the same case in The Failure of Risk Management (see our list of the best risk management books). The fix is not to drop heat maps but to feed them with numbers: estimate the probability and the dollar impact of the principal risks, and use the heat map only to show the results. We go further in why your current risk assessment process sucks.
Heat map vs. risk register vs. assurance map
| Tool | Question it answers | Rows | Columns |
|---|---|---|---|
| Risk register | What could go wrong? | Risks | Cause, impact, likelihood, owner, controls |
| Risk heat map | How big is each risk? | Impact | Likelihood |
| Assurance map | How do we know each risk is controlled? | Risks | Assurance providers |
The register lists the risks, the heat map ranks them, and the assurance map shows who checks that their controls work.
Frequently asked questions
What is a heat map in risk assessment?
A colour-coded grid that ranks risks by likelihood and impact. It summarizes the results of a risk assessment for managers and boards.
Is a risk heat map the same as a risk matrix?
Nearly. A risk matrix is the grid with its scales and bands; a heat map is the matrix with the organization's risks plotted on it. Many people use the terms interchangeably.
What colours does a risk heat map use?
Most use green, amber (or yellow) and red. Some add a fourth band, often orange or dark red, for risks beyond the board's tolerance.
Should a heat map be 3x3, 4x4 or 5x5?
A 5x5 grid is the most common in enterprise risk management. A 3x3 grid is easier to rate consistently but separates risks less. Choose the size your scales can support with evidence.
How do I make a risk heat map in Excel?
Build the grid as a table, score each risk, and apply conditional formatting to colour the cells by score. Most governance, risk and compliance software builds the map from the risk register automatically.
