Risk Matrix Generator

A risk register that lists twenty risks and calls them all important is a document nobody reads twice. What makes one comparable is scoring the same four things for every entry: how likely it is, how bad it would be, whether you would see it coming, and how well it is controlled already. This does that scoring consistently, which is the part a spreadsheet lets you skip and the part that makes the register useful.

Risks to assess

One per line. Describe the risk, not the mitigation.

How you are scoring risk

Weights are relative — 3 against 1 means three times as important. They are normalised to add up to 100%, and the share each one ends up with is shown below.

Score each one out of 10

Scores for each option against each criterion
Option	Likelihoodhigher is better	Impacthigher is better	Detectabilityhigher is better	Current controlhigher is better
Key supplier fails
Data loss
Key person leaves
Budget cut

Score the options, then press the button.

What this generator does

Scores risks consistently rather than suggesting them. The risk prompt generator on this site helps you find risks you had not thought of; this takes the ones you already have and makes them comparable. All four criteria are set higher-is-better so a high total means a risk that is likely, damaging, hard to see coming and poorly controlled — the ones that deserve attention first.

How to use this tool

List the risks — the thing that could go wrong, not the mitigation.
Adjust the weights if your organisation weighs these differently.
Score each risk out of 10 on each criterion.
Press score to get the register in order.

Understanding the controls

Risks: One per line. Describe the thing that could go wrong rather than what you would do about it — 'key supplier fails', not 'find a second supplier'.
Likelihood and impact: The two everybody scores. Weighting impact above likelihood is common, and is the default here.
Detectability: How likely you are to see it coming. Score high for a risk that would arrive without warning — those are worse, not better, which is why it is higher-is-better here.
Current control: How exposed you are now. Score high where there is little or nothing in place. A well-controlled risk should fall down the register, and this is the field that does it.

Worked examples

Likely, damaging, uncontrolled: Scores at the top — the register's first conversation.
Catastrophic but well controlled: Falls down the list, which is what the control score is for.
A risk you would spot months out: Scores low on detectability, and drops accordingly.
Two risks tied: Shown at the same rank, which usually means they need a fifth criterion.

Common use cases

Building or reviewing a project risk register
Deciding which risks are worth a mitigation plan and which are worth watching
Comparing risks raised by different teams on the same scale
Preparing for a governance or board review
Revisiting a register after something changed, to see what moved

How this generator works

The same weighted-sum engine as the other matrices: weights normalised to sum to 1, totals computed from score times normalised weight, ties sharing a rank. The scoring convention is stated on the page rather than assumed — all four criteria are oriented so that a higher score means more risk, which avoids the sign error that makes half of hand-built risk registers rank backwards.

Randomness and fairness

Nothing here is random. The same risks and scores always produce the same register order.

For how randomness is produced across the whole site, see how Generate Random works.

Assumptions this tool makes

All four criteria are oriented so that higher means more risk, and each risk is scored independently of the others.

Limitations and good to know

This is a scoring aid, not a risk-management methodology, and it is not aligned to any particular standard.
It cannot tell you whether your scores are right, and risk scoring is notoriously optimistic.
It does not model correlated risks — two risks that would happen together are scored as though they are independent.
It has no view on risk appetite, which is what turns a score into a decision.
The register is not stored anywhere, which is deliberate for confidential entries — copy it into your own risk log.

Common mistakes

Writing the mitigation instead of the risk: 'Find a second supplier' cannot be scored for likelihood. Write what could go wrong, then score that.
Scoring control backwards: Here a high control score means poorly controlled — more exposure, higher risk. The page states the convention because getting it wrong inverts the whole register.
Treating the score as a decision: A score orders the register. What to do about the top item is a judgement about appetite and cost that no matrix contains.

Practical tips

Score the register with more than one person and compare where you disagree — those rows are where the real risk usually is.
Rescore after each mitigation lands, so the register reflects the current position rather than the original one.
Keep the wording of each risk short enough to score; long risks are usually two risks.

Privacy and your data

Your risk descriptions and scores stay in your browser. Nothing is uploaded, nothing is stored between visits, and none of it is written into the page address — which matters, because a risk register is usually confidential. Analytics records that the tool ran and how many risks were scored, never any text.

Frequently asked questions

Is this a standard risk methodology?: No, and it does not claim to be. It is a consistent way of scoring a register you already have. If your organisation mandates a particular framework, use its criteria and weights here rather than these.
Why include detectability and control?: Because likelihood and impact alone rank a well-controlled catastrophe alongside an unmonitored one. How much warning you would get, and what is already in place, are what separate them.
Does a high score mean we should act?: It means act *first* relative to the rest of the register. Whether the top risk warrants spending anything at all is a question about appetite and cost, and this does not answer it.