Risk Assessment Matrix Calculator
Turn a list of project risks into a ranked, defensible risk register. Score probability, impact and detection for every risk, then read the Risk Priority Number, the 5 by 5 matrix position and the residual risk left after your mitigation plan.
🎯 What this calculator does
This tool converts a list of project risks into a scored, ranked risk register. You enter each risk once, rate how likely it is, how badly it would hurt, and how quickly you would see it coming. The calculator returns a Risk Priority Number for every risk, places each one on a 5 by 5 matrix and totals the exposure across your whole register.
Most risk registers are colour only. A red risk and another red risk look identical, so the team argues about which one to fund. The Risk Priority Number breaks that tie. It multiplies probability by impact by detectability, which produces a score from 1 to 125 and a clear order of work.
The tool also asks for your expected position after mitigation. That gives you the residual risk, so you can prove whether the money you plan to spend actually moves the number. A mitigation plan that reduces RPN by 8 points is not a plan. It is a note.
📐 The three formulas in plain words
Risk score is probability multiplied by impact. It runs from 1 to 25 and sets the matrix colour.
Risk Priority Number multiplies the risk score by detectability. Detectability is the inverse of your detection capability, so excellent monitoring rated 5 becomes a detectability of 1 and cuts the RPN. Poor monitoring rated 1 becomes a detectability of 5 and multiplies it.
Portfolio exposure index divides the total RPN across your register by the theoretical maximum of 125 per risk, then converts it to a percentage. One number you can track quarter by quarter.
💡 Why detection belongs in the score
Two risks can share the same probability and impact and carry completely different real exposure. A supplier failure you spot 8 weeks out is manageable. The same failure discovered on the delivery date stops production. Detection capability is the difference between a managed risk and an incident, so it belongs in the arithmetic rather than in a footnote.
📋 How to use it
- List your risks first. Aim for 6 to 12 real risks rather than 40 generic ones. Write each as a cause and a consequence, for example "Single source supplier fails to deliver, halting line 3".
- Assign a category and an owner. A risk with no named owner never gets managed.
- Rate probability from 1 to 5 using evidence. Use historical frequency, supplier performance data or expert judgement, not gut feel.
- Rate impact from 1 to 5 against the cost, delay and disruption bands shown in the dropdown. Use the worst of the three, not the average.
- Rate detection capability from 1 to 5. Ask one question: how many days of warning would we actually get today.
- Choose a response strategy. Avoid, transfer, mitigate or accept. Every risk needs one.
- Enter the residual ratings you expect once the response is in place. Leave them equal to the current ratings if nothing changes.
- Click Calculate risk profile. Review the matrix, the ranked table and the recommended actions, then export the branded Excel risk register.
📊 RPN bands and what to do
| RPN band | Score range | Meaning | Required action |
|---|---|---|---|
| Critical | 100 to 125 | Likely, severe and effectively invisible until it lands | Escalate to the sponsor this week. Fund a dedicated response. |
| High | 50 to 99 | Serious exposure with weak early warning | Named owner, dated mitigation plan, fortnightly review. |
| Medium | 20 to 49 | Real but manageable with standard controls | Monthly review. Improve detection before adding controls. |
| Low | 8 to 19 | Minor exposure, adequately controlled | Log and monitor at the normal project cadence. |
| Very low | 1 to 7 | Negligible | Accept and review only if conditions change. |
🧭 The four response strategies
Avoid
Change the plan so the risk cannot occur. Drop the scope item, change the technology or remove the dependency. The only strategy that takes exposure to zero.
Transfer
Move the financial consequence to another party through insurance, a fixed price contract or a liquidated damages clause. The event can still happen.
Mitigate
Reduce probability, reduce impact or improve detection. The default for most project risks and the one this calculator measures through residual RPN.
Accept
Acknowledge the risk, set a trigger and hold contingency. Valid for low scores. Dangerous when applied to a critical RPN because it is often avoidance in disguise.
⚠️ Common mistakes
- Rating everything a 3. A register where every risk sits mid scale gives you no ranking and no decision.
- Confusing detection capability with detectability. In this tool, 5 means excellent detection, which lowers the RPN. The inversion is handled for you.
- Writing an issue instead of a risk. If it has already happened it belongs in the issues log, not here.
- Accepting a critical risk because mitigation looks expensive. Price the exposure first, then compare.
- Setting residual ratings that are wildly optimistic. If the plan cannot deliver the drop, the register lies to your sponsor.
- Leaving the owner blank. Unowned risks stay at their opening score for the life of the project.
✨ Pro tips
- Rate the register as a group, not alone. Divergent scores are the useful part of the conversation.
- Improve detection before you spend on prevention. Moving detection from 2 to 4 cuts RPN by 50 percent for free in many cases.
- Set a trigger and a threshold for every accepted risk so the acceptance has a review date attached.
- Rerun the register at every phase gate. Probability shifts as the project progresses even when nothing else changes.
- Track the portfolio exposure index over time. A single trending number survives a steering committee better than a heat map.
- Carry the top three RPN risks into your project charter so the sponsor signs off knowing them.
🔄 Where this fits in DMAIC
This is a Define phase tool. You build the register while writing the project charter, so the sponsor approves the work with the exposure visible. It stays live through Measure and Analyse as new risks surface from the data, and it becomes an input to the Control phase, where the residual risks with the highest RPN become monitored items in the control plan.
The same scoring logic sits behind FMEA in the Improve phase. The difference is scope. FMEA scores failure modes inside a process step. This calculator scores risks across the whole project, including commercial, resourcing and external risks that no process map will show you.
📥 Load a sample dataset
Load an industry register to see how the scoring behaves, then replace it with your own risks. The plant automation set is deliberately poor so you can see the red and orange indicators.
🧾 Risk register
Enter one risk per card. Rate the current position first, then the position you expect once your response strategy is in place.
⚠️ No analysis yet
Enter your risks in the Calculator tab and click Calculate risk profile to generate your ranked risk register.
What is a risk assessment matrix
A risk assessment matrix is a grid that plots every identified risk by how likely it is against how badly it would hurt. The standard version is 5 by 5, which gives 25 cells and a risk score from 1 to 25. Cells in the top right carry the highest exposure and drive the most urgent response.
The matrix on its own has a known weakness. Several risks land in the same red cell and the register cannot tell you which to fund first. This calculator solves that by adding detection capability and calculating a Risk Priority Number, which spreads the ranking across a 125 point scale and separates risks that a colour grid treats as identical.
How to calculate a Risk Priority Number
Multiply three numbers. Probability from 1 to 5, impact from 1 to 5 and detectability from 1 to 5. Detectability is the inverse of your detection capability, so it equals 6 minus your detection rating. A risk rated probability 4, impact 5 and detection capability 2 produces a detectability of 4 and an RPN of 80.
The scale runs from 1 at the bottom to 125 at the top. Scores of 100 and above are critical and need executive attention. Scores from 50 to 99 need a dated mitigation plan and a named owner. Scores below 20 are usually accepted and monitored.
The inversion matters. Excellent monitoring rated 5 gives a detectability of 1, which drops the RPN to the plain risk score. Poor monitoring rated 1 gives a detectability of 5, which multiplies the exposure fivefold. That single relationship is why improving detection is often the cheapest risk reduction available to a project team.
Current risk versus residual risk
Current risk is where you sit today with the controls you actually have. Residual risk is where you expect to sit once the response strategy is delivered. The gap between the two is the value of your mitigation plan, expressed as a number instead of a promise.
Sponsors approve risk spend when they can see that gap. A plan that takes RPN from 100 to 36 has delivered a 64 percent reduction and justifies the budget. A plan that moves RPN from 100 to 90 has not, and it usually means the controls address the symptom rather than the cause.
Set residual ratings honestly. Optimistic residual scores are the most common way a risk register misleads a steering committee, because the register shows a green future state that no one has funded.
The four risk response strategies
Avoid
Remove the risk by changing the plan. Drop the scope item, switch supplier or change the sequence. The only strategy that drives residual risk to zero, and usually the most expensive up front.
Transfer
Shift the financial consequence through insurance, warranties or contract terms. Useful for high impact and low probability risks. The event can still occur, so detection still matters.
Mitigate
Reduce probability, reduce impact or improve detection. The default response for most project risks and the one the residual scoring in this calculator is designed to measure.
Accept
Log the risk, set a trigger and hold contingency. Correct for low RPN items. Applying it to a critical RPN without a documented rationale is how projects get audited.
How many risks should a register hold
Between 6 and 15 for a typical improvement project. Registers with 40 entries are usually a mix of real risks, issues that already happened and assumptions dressed up as risks. Nobody reviews them and the top exposure hides in the noise.
- Write every entry as a cause and a consequence so the wording forces a real risk
- Move anything that has already occurred into the issues log
- Merge duplicates that share a single root cause and a single owner
- Delete risks that no longer apply to the current phase rather than carrying them
- Keep the register to one page so the steering committee actually reads it
Who uses this calculator
- Green Belts and Black Belts building the risk section of a Define phase project charter
- Project and programme managers preparing a register for a steering committee
- Operations managers assessing exposure before a plant, system or process change
- Quality professionals running FMEA style scoring outside a formal FMEA workshop
- Compliance and audit teams evidencing that risks were scored on a consistent basis
- Change leaders quantifying the exposure created by a transformation programme
What to do after the analysis
- Take every risk scoring 100 or above to the sponsor before the next gate.
- Give each high RPN risk a named owner, a dated mitigation action and a review cadence.
- Improve detection on any risk rated 1 or 2 for detection capability before spending on prevention.
- Set a trigger and a threshold for every accepted risk so the acceptance carries a review date.
- Move the residual risks with the highest scores into the Control phase control plan.
- Rerun the register at each phase gate and track the portfolio exposure index over time.
Related Lean Six Sigma calculators
- Stakeholder Impact Calculator identifies who your risks and mitigations actually affect.
- Change Management Readiness Calculator scores the organisational risks a matrix often misses.
- Project Selection Scoring Calculator weighs risk against benefit before you charter the work.
- VOC Priority Matrix Calculator ranks the customer requirements your project is protecting.
- Business Case Financial Calculator prices the exposure so mitigation spend can be justified.
- Control Charts Calculator builds the detection capability that lowers your RPN.
Frequently asked questions
How do you calculate a Risk Priority Number?
Multiply probability by impact by detectability. Detectability equals 6 minus your detection capability rating, so excellent monitoring reduces the score and poor monitoring multiplies it. On a 1 to 5 scale the RPN runs from 1 to 125.
What is a good RPN score?
Below 20 is generally accepted and monitored. From 20 to 49 needs standard controls and a monthly review. From 50 to 99 needs a dated mitigation plan and a named owner. Anything at 100 or above is critical and belongs in front of the project sponsor.
Why does detection capability lower the risk score?
Warning time changes exposure. A supplier failure spotted eight weeks out is a scheduling problem. The same failure found on the delivery date stops production. Detection capability rated 5 gives a detectability of 1, which cuts the RPN back to the plain probability and impact score.
What is the difference between current and residual risk?
Current risk is your position today with existing controls. Residual risk is the position you expect once the response strategy is delivered. The reduction between the two is the measurable value of your mitigation plan and the number a sponsor should be shown before approving spend.
Is a 5 by 5 risk matrix the same as an FMEA?
No. FMEA scores failure modes inside a specific process using severity, occurrence and detection, usually on a 1 to 10 scale. This calculator scores project level risks across all categories, including commercial and external risks that a process FMEA never covers. The scoring logic is closely related.
How often should the risk register be reviewed?
At every phase gate as a minimum, and monthly for any risk scoring 50 or above. Probability shifts as a project progresses even when nothing else changes, so a register older than a quarter usually points at the wrong priorities.
Can I export the risk register?
Yes. The calculator generates a branded four sheet Excel workbook containing a summary with the formulas used, your raw input ratings, the ranked RPN analysis and an action plan with owners, priorities and review timing.
