What the grid is
A risk heat map plots each risk by how likely it is and how bad it would be. Likelihood runs along one axis, consequence along the other, and the cells are shaded from low to extreme. It is a picture of your register, not a substitute for it.
| Likelihood / Consequence | Minor | Moderate | Major | Severe | Critical |
|---|---|---|---|---|---|
| Almost certain | Medium | High | High | Extreme | Extreme |
| Likely | Low | Medium | High | High | Extreme |
| Possible | Low | Medium | Medium | High | High |
| Unlikely | Low | Low | Medium | Medium | High |
| Rare | Low | Low | Low | Low | Medium |
Rate the risk you have now, then the risk you will have
Most registers show two ratings. The current rating assumes the controls you have today work as they do today. The target rating is where you expect the risk to sit once planned treatments are done. If the two are the same, either the risk is already where you want it or nobody has planned anything.
Watch for these traps
Clustering in the middle: if most risks sit in the centre cells, your rating criteria are probably too vague. Write down what "likely" and "major" mean in your organisation, in time frames and in dollars, people or service terms.
Moving risks without evidence: a risk should only move from red to amber when a control has been tested or a treatment completed, not because a meeting felt calmer.
High impact, low likelihood risks fading from view: the corner of the grid where rare but severe events sit is where continuity planning earns its keep. Keep those risks on the agenda even when they rate low on likelihood.
Questions to ask in the meeting
Which risks moved since last time, and what evidence moved them? Which controls have we actually tested? Which treatments are overdue, and who owns them? Is anything outside our appetite, and what are we doing about it?