The risk matrix
The matrix is your company's risk language. It is configured once by an administrator, and every assessment afterwards is measured against it.
Only the company admin can configure the matrix. Until it is generated, assessments cannot be scored.
Configuring it
Matrix size
| Size | Use |
|---|---|
| 4×4 | Tactical assessment for localised risk environments. |
| 5×5 | The industry standard for enterprise-wide qualitative analysis. |
| 8×8 | Fine-grained, for high-security infrastructure audits. |
Functional consequence definitions
This is the part worth spending time on. For each severity level you describe what it means in concrete terms across the categories your operation cares about — injury, vessel damage, environmental release, reputation, business impact, regulatory standing.
These definitions are what make scoring consistent between people. Without them, one assessor's "Major" is another's "Medium".
Probability thresholds
Likelihood levels are defined the same way, so "Possible" means the same thing to everyone.
Score bands
Where Low becomes Medium, and Medium becomes High. Bands must be contiguous and cover the whole range the matrix can produce.
Reviewing it
Once generated, Final Risk Matrix Review shows the complete scored grid before anyone uses it.
Read the grid before approving it. Check the corners: the most severe and most likely combination should be your highest score and sit in the High tier. If it does not, the scales are numbered in opposite directions.
Regenerating the matrix changes the scale future assessments are measured against. Existing reports keep the scores they were given. Treat a change as a policy decision, not a tweak.