What is a Probability and Impact Matrix?

What does risk management look like on your projects?

Some companies have robust, established risk management procedures. Others almost entirely ignore the idea of risk and hope for the best.

Mostly ignoring risk is an understandable choice in some scenarios: if the project is a low priority, if constraints such as timeline or budget aren’t very rigid, or if you’re using an agile process and only making detailed plans a week or two in advance, so you're naturally planning and prioritizing around the latest project obstacles.

But it is usually wise to give at least some thought to risk, and risk is sometimes ignored in scenarios where it’s unwise to do so.

If you’ve never done risk management on a project before, or if your company has never done it and you’re having instincts that it needs to start, I recommend trying a probability and impact matrix as the central tool to organize your thinking and communication about risk. It will be easy for you and your team to understand as first-time users, while still providing a robust way to ensure each risk gets the right investment of time and effort.

Here's how to use one.

1. Identify Your Risks

Unfortunately a probability and impact matrix won’t help you identify risks. This is something you’ll need to do before you can use the matrix.

Identifying risks is a non-linear process of brainstorming, asking lots of questions, researching past project data, researching industry trends and news, and any number of other exploratory efforts to gather a list of possible risks for your project. It is similar to the process of gathering project requirements, or identifying organizational process assets and enterprise environmental factors that affect your project, as I shared in a recent post—but probably requires even more creativity than both of these, because risks can come from far-flung sources.

The best risk identification advice I can give you is:

1. Do your best.
2. Get input from people at your company who have different vantage points than you do.
3. As your project progresses, pay special attention to the risks or issues that arise that you didn’t anticipate…and make yourself the appropriate reminders or checklists to think about these types of risks on future projects. You’ll get better at it.

Once you’re to the point that you have a list of possible risks to your project, then you’re ready to think about their probability and their impact.

2. Estimate Probability and Impact

Let’s say your project is building a treehouse for your kids in your backyard, and these are the risks you’ve identified:

1. A spike in the price of lumber could affect your ability to acquire materials.
2. You want help from your siblings, but they might not be available.
3. A major work project could impact your own availability to work on it.
4. You could fall and be injured while doing construction work in a tree.
5. You might make mistakes because you’ve never built a treehouse before.

Next, you’ll want to ask yourself two questions about each risk:

• How likely is this risk to happen? This is the probability.
• How significantly will it affect the project if it happens? This is the impact.

How do you answer those questions? When you’re using a probability and impact matrix, you’ll want to answer with a number—usually a decimal between 0 and 1.

Here’s how you might choose these numbers for risk 1:

• How likely is a spike in the price of lumber? Well, lumber price spikes are uncommon, and there was one recently in your area that has already passed, so let’s say 0.3 probability.
• If there is a lumber price spike, how much will that affect your project? As wood is the main building material you plan to use, the impact could be significant. You could consider other materials, or perhaps look for secondhand wood, but neither of these options is ideal. So let’s call the impact 0.7.

Repeat this reflection process for each risk. On a company project, you might go through this process with a committee, or even do a bit of research before choosing numbers.

Here is the list of risks with a probability and impact measurement identified for each:

1. A spike in the price of lumber could affect your ability to acquire materials.
   • Probability 0.3, Impact 0.7
2. You want help from your siblings, but they might not be available.
   • Probability 0.4, Impact 0.6
3. A major work project could impact your own availability to work on it.
   • Probability 0.2, Impact 0.6
4. You could fall and be injured while doing construction work in a tree.
   • Probability 0.1, Impact 0.9
5. You might make mistakes because you’ve never built a treehouse before.
   • Probability 0.7, Impact 0.4

Now that we have probability and impact estimates, let’s combine them and determine overall priority level for each risk by plotting them on a matrix.

3. Plot on a Matrix

The PMBOK® Guide—Sixth Edition and the PMBOK® Guide—Seventh Edition from PMI define probability and impact matrix this way:

“A grid for mapping the probability of occurrence of each risk and its impact on project objectives if that risk occurs.”

As you can see, a ‘matrix’ is simply a grid, like a table or a spreadsheet: think rows and columns. But in the case of a probability and impact matrix, the grid also has an x-axis and a y-axis like a graph, to indicate the level of probability and the level of impact.

With this definition in mind, let’s look at a probability and impact matrix:

Every colored box on the grid represents the corresponding probability and impact levels multiplied together. It allows you to identify an overall numeric significance level—or overall score—for a risk with any combination of probability and impact estimates.

In this example matrix, anything up to 0.14 is considered a low risk, anything from 0.15 to 0.34 is considered a medium risk, and anything 0.35 or higher is considered a high risk. These qualitative levels can be customized based on what makes sense for your company or project.

The five numbers in black are the overall scores for the five risks on our sample project. Do you see how this provides a great visual sense of how significant each risk is?

4. Act on Risks Accordingly

Now that you have this pretty visual aid for your risks, what’s next?

First, you’ll want to re-order your risks according to their scores:

1. [0.28] You might make mistakes because you’ve never built a treehouse before.
2. [0.24] You want help from your siblings, but they might not be available.
3. [0.21] A spike in the price of lumber could affect your ability to acquire materials.
4. [0.12] A major work project could impact your availability to work on it.
5. [0.09] You could fall and be injured while doing construction work in a tree.

This is the priority order and tells you how much effort you’ll want to put into preparing for or preventing each risk, relative to the other risks. If you put a lot more effort into making sure your job won’t affect your availability (risk 4) than you do into making sure you have enough help (risk 2), your efforts would be disproportional, and not in line with your (hopefully) realistic estimates.

On the other hand, maybe you’ll get to this point and feel in your gut that the priority order is wrong. Does anyone else feel like preventing injury shouldn’t be the lowest-priority risk? In this case, maybe you’d go back and conclude that 0.2 is a better probability estimate for the injury risk, which would increase its score to 0.18 and move it to the medium category. Alternatively, you might conclude the boundaries between your categories need adjusting.

This leads to the second way the matrix helps us think about risks: not just priority relative to each other, but relative to categories, like the low, medium, and high categories in the example matrix. You have the opportunity to simplify risk planning by determining that all risks in a given category get the same amount of effort devoted to them. For the example project, you might decide that all medium risks get simple contingency or prevention plans (for example, to address risk 1, you could do a little research on building treehouses), whereas all the risks in the low category might simply be accepted (which means you don’t take any actions to address them; you just keep them in mind).

Thinking About Risk

On a large or complex project, creating a probability and impact matrix is an excellent way to create shared language for project risks. This is especially true when extensive team time will go toward addressing risks—you’ll want to make sure that time is spent appropriately and proportionally.

On a smaller or simpler project, you may not need to write out the risks or create an actual matrix. You may simply be able to do some quick probability and impact math in your head, plot the overall score on an imaginary matrix, and have an immediate sense of how much effort a given risk warrants.

The truth is that you don’t need the matrix to do the math or take any of the subsequent prioritization steps, but the visual can be helpful for both your own understanding and for communication with your team.

I hope you now feel equipped to have meaningful and productive risk conversations that lay the foundation for intelligent risk plans. This simple tool can take you a long way.