Risk heat map

A risk heat map is the visual form of the consequence/likelihood matrix described in ISO/IEC 31010:2019 as a risk assessment technique. Typical layouts are 3×3, 4×4 or 5×5, with each axis level defined by anchored descriptors: likelihood as frequency bands ("less than once in ten years", "several times a year") and consequence as thresholds per impact type (money lost, hours of outage, number of records exposed, regulatory action). The colour of each cell is a policy decision, not a calculation; it encodes the risk criteria and should line up with the documented risk appetite, so that "red" means the same thing as "outside appetite, treatment required". NIST SP 800-30 Rev. 1 Appendix I gives an example of such a lookup from likelihood and impact levels to an overall risk level.

The most common implementation multiplies ordinal scores, likelihood 1-5 times impact 1-5. This treats ordinal labels as ratio numbers, which they are not: the gap between "rare" and "unlikely" is not the same as between "likely" and "almost certain". The product also has only 14 distinct values between 1 and 25, and identical scores hide very different profiles: a 5×1 nuisance and a 1×5 catastrophe both score 5. Many organisations therefore use asymmetric matrices where high-impact columns turn red at lower likelihood, or define cell colours directly instead of from products.

Louis Anthony Cox Jr.'s paper "What's Wrong with Risk Matrices?" (Risk Analysis, 2008) formalised the limits: range compression puts quantitatively very different risks in the same cell, cell boundaries can rank a smaller risk above a larger one, and when frequency and severity are negatively correlated a matrix can do worse than random prioritisation. Placement is also subjective, so two assessors routinely put the same scenario in different cells. A heat map therefore supports discussion and triage but does not compute risk, and it cannot aggregate: ten yellow risks sharing one dependency may be worse than a single red one.

Good practice is to plot each risk twice, inherent and residual, with an arrow showing the effect of treatment; to show trend since the previous report; to keep a written rationale behind every placement; and to switch to quantitative analysis for the few risks where a large investment decision depends on the ranking.