Risk map
Identify the risks to your project, place them by likelihood and impact, and decide what you will do about the ones that matter.How the risk map works
Every project carries risks worth naming before they arrive. This risk map is a simple 3x3 grid. You add each risk, place it by how likely it is to happen and how much damage it would do, and record what you intend to do about it.
Placing a risk on the grid forces two judgements teams often skip. Likelihood asks how probable something really is, rather than how vivid it feels after a bad week. Impact asks what it would actually cost you if it landed. Separating the two stops the loudest worry in the room from crowding out the risk that would genuinely hurt you.
Reading the nine positions
The grid gives you nine positions, and each one implies a different response:
- High likelihood and high impact: mitigate now, and plan for it happening anyway
- High likelihood and medium impact: mitigate, and give it a named owner
- High likelihood and low impact: accept it, but monitor so it does not compound
- Medium likelihood and high impact: mitigate, and agree in advance what triggers escalation
- Medium likelihood and medium impact: plan a response and review it at each checkpoint
- Medium likelihood and low impact: monitor
- Low likelihood and high impact: build a contingency, because the cost of being wrong is high
- Low likelihood and medium impact: monitor
- Low likelihood and low impact: record it and move on
The common failure is treating the top-right cell as the whole exercise. Low-likelihood, high-impact risks are the ones that sink projects, precisely because nobody planned for them.
Using the risk map in a session
The tool works well as a group activity. Ask each person to add risks independently first, before anyone sees the others' entries, so that the quiet concerns surface alongside the obvious ones. Then place them on the grid together. Disagreement about where a risk sits is the useful part of the conversation, not an obstacle to it.
Nothing is sent anywhere, and the map lives in your browser, so it is safe to use with commercially sensitive material.
Risk mapping pairs naturally with a risk management business simulation, where teams meet the consequences of the risks they chose to ignore.