Probability and impact matrix

The probability and impact matrix is a table that is used to plot each risk after performing a probability and impact assessment. The probability and impact assessment determines the probability and impact of the risk. This matrix provides a helpful way to view the various risks on the project and prioritize them for responses. It may be constructed for threats and opportunities. Information from this matrix will be trans- ferred to the risk register.

This matrix also provides an overview of the amount of risk on the project. The project team can get an idea of the overall project risk by seeing the number of risks in each square of the matrix. A project with many risks in the red zone will need more contingency to absorb the risk and likely more time and budget to develop and implement risk responses.

The probability and impact matrix can receive information from:

  • Risk management plan
  • Probability and impact risk assessment
  • Risk register

It provides information to the risk register.

The probability and impact matrix is a tool used in 11.3 Perform Qualitative Risk Analysis in the PMBOK® Guide – Sixth Edition. It is updated throughout the project.


Tailoring tips

Consider the following tips to help tailor the probability and impact matrix to meet your needs:

  • The matrix can be a 3 × 3 for a small project, 5 × 5 for a medium project, and 10 × 10 for a complex or large project.
  • The numbering structure of the probability and impact matrix can be tailored to emphasize the high risks by creating a nonlinear numbering structure. For example, impact scores can be set up to double every increment. For example: Very Low = .5, Low = 1, Medium = 2, High = 4, and Very High = 8.
  • The relative importance of the objectives can be If schedule is most important you may weight that as 40 percent of the score, whereas scope, quality, and cost all have a weight of 20 percent (make sure the total is 100 percent).
  • The combination of probability and impact that indicates a risk is high, medium, or low can be tai- lored to reflect the organization’s risk An organization with a low risk appetite may rank events that fall in the medium or high range for both impact and probability as high risk. An organi- zation with a higher risk threshold may only rank risk with a very high probability and impact as high risk.



The probability and impact assessment and matrix should be aligned and consistent with the following documents:

  • Risk management plan
  • Risk register
  • Probability and impact assessment
  • Stakeholder register