What is Risk Matrix? Why is it useful?

Risk Matrix is a matrix that is used during Risk & Control Self-Assessment (RCSA) activity to define the various levels of risk at each stage, activity, process and sub-process. Risk Matrix comprises of: Impact analysis Likelihood Operating Effectiveness Design Effectiveness Ratings are assigned to all above categories, pre and post control environment. Based on the ratings a Gross/ Inherent Risk Level and Residual Risk level is determined (HIGH/MEDIUM/LOW), respectively. In the event where Residual Risk level is HIGH and/or a particular control environment is weak, these are mitigated with additional controls. The Inherent and Residual Risks follow the RED-AMBER-GREEN colour-coding mapped to HIGH-MEDIUM-LOW Risks, respectively. Usefulness: Risk Matrix helps an organisation to prioritise its actions so that high impact risks that need to be managed are considered first. This provides maximum pay-off to the organisation from its risk management efforts.