How to Create a Project Risk Matrix

quantify risk value of project

10 Easy Steps to Estimate the Cost of Risk


Whether we are developing something new for a customer, or leading an initiative to improve the company, every project we undertake contains some level of uncertainty.  Because of this, and particularly when the stakes are high, some level of risk analysis is always a good idea.  However, managing risk means more than simply keeping a watchful eye on a few things we write down in a notebook.  Instead, managing risk can and should be the result of a much more deliberate activity, in which you actually quantify a financial value for risk and unknowns.  We can do this by easily creating a risk assessment matrix and factoring the values we generate into our project business case.  Let’s take a closer look at how we can manage the uncertainty of a new project.

What is a Risk Assessment Matrix?

A risk matrix is a tool.  It is a tool that helps Program Managers capture, summarize and track potential issues that may arise over the duration of a project.  Typically, a risk matrix will be used to monitor concerns within the project team, as well as to summarize key information for individuals outside the immediate team.

There are many risk management tools out there, including things like heat maps, high-medium-low ranking templates and others.  However, the risk template we prefer calculates the expected value of risk by estimating the financial impact each item may have on the project.

Moreover, unlike other methods, the expected value approach for risk evaluation decomposes complex issues like project delays, customer driven changes, and internal constraints into a single variable (cost).  Having a standard variable to measure risk makes it far easier to rank and prioritize issues than if you were to try to compare a project delay (time) to a resource gap (people).

You can download our free risk assessment matrix template below:


Risk Assessment Matrix
Risk Assessment Matrix
Version: v1
521.0 KiB
Free MRH Download: Risk Assessment Matrix

A Risk Assessment Matrix is a tool that enables project teams plan for problems, manage risk, prioritize action, and communicate to others. This template provides step-by-step instructions that teach you how to create your own risk evaluation, and also shows you how to quantify the value of the risk. You can find all of our free templates on our TOOLS AND TEMPLATES PAGE.


Why Worry About Risk Since it Hasn’t Happened?

The idea of tracking possible problems may seem strange given they may never happen.  However, creating a risk summary at the beginning of a project helps us plan and manage the cost associated with issues in the event that they actually do occur.  In addition, a risk matrix centralizes key concerns that may affect the results of the project, as well as creates a consolidated summary for reporting purposes.

Possible Impacts of Not Creating a Project Risk Matrix:

  • Missing the financial and commercial targets of the work
  • Over-extending resources and capacity to address future issues
  • Unable to prioritize challenges as they emerge
  • Not understanding how risks may affect the project outcome
  • Loss of customer confidence

Typically, when looking at a new business opportunity, or outlining an internal initiative, we often look at it in terms of an investment.  Thus, including a well-defined financial value that reflects the amount of anticipated risk strengthens the business case and the decision to proceed.

In short, spending the time to evaluate risk early on prepares you for issues before they happen.  Now, let’s take a look at how to create a risk assessment matrix with the following 10 steps.

Step 1: List the Risks for the Project

The first step in creating a project risk template is to capture a list of the potential risks that may affect the project.  An effective way to do this is to meet with the project team and key stakeholders, and simply brainstorm.  Include as many risks to a specific project or program that you can think of, and group them as needed.

Bear in mind that the items you list should be relevant and real.  Ignore items that, while possible, are highly improbable or unrealistic.  For example, goods you ship to your customer can certainly be damaged in transit.  But this is not common and highly unlikely, and you should therefore ignore it.

Types of Risk to Include in Your Evaluation Matrix:

  • Schedule Delays
  • Changes in Requirements
  • Rework
  • Lessons Based on Prior Experience
  • Costs That Cannot Be Recovered by Contractual Agreement

While you want a thorough list of risks, adding unrealistic items into your financial model leads to unachievable business cases, and discourages you from pursuing good opportunities.

RELATED: 16 Tips for New Project Managers

Step 2: Identify the Impact to the Project

After you’ve listed the main items of concern, the next step in creating a risk matrix is to identify the potential impacts to the program.  In other words, if the risk became real, what actions would you have to take?  How would it affect the project?  To help you identify the possible impacts, answer the following questions.

7 Questions to Help You Evaluate Impact of Risk, Should it Occur:

  1. What action(s) would you need to take?
  2. What unplanned activity would result?
  3. What new or additional effort would be required?
  4. How would the risk affect your resource levels?
  5. Are there additional expenses as a result?
  6. Would additional time be needed to complete the project?
  7. What is required per contractual obligations?

Even though your risk matrix is simply a summary of potential issues that may affect your project, it’s still a good idea to think carefully about what might happen if one of the issues becomes reality.  Many project managers forget this important aspect of risk management, and are left scrambling when problems arise.

Step 3: Characterize the Type of Risk

Briefly identify the nature of the risk.  You may wish to classify the risk by its impact such as schedule, cost, and resources.  Or, you may want to classify it by other attributes, such as a product family, a region, or by customer.  In many cases, a given risk item may affect more than one category.  For example, if a customer changes their requirements, it will likely require more time (cost) from your team, as well as delay the project (schedule).

Again, a risk matrix is a tool that is often used to communicate information about a project.  A general characterization of each risk makes it easy to sort information, and allows one to quickly evaluate how each item may impact the work you are doing.

Step 4: Summarize Mitigation Strategies

While it is true that you cannot influence or eliminate all risks for a given project, there are typically some things you can do to help manage the outcome.

Take, for example, your customer’s schedule.  While you may not be able to control the customer’s behavior or schedule decisions, you may be able to negotiate the contractual agreement such that you are entitled to compensation for delays or extra effort.

Identify mitigation strategies for each risk by examining how you can influence a situation, or outlining ways to protect yourself.  Mitigation strategies may include work you do behind the scenes, or specific demands you seek as part of a the business arrangement.

Step 5: Identify an Owner for Each Risk

Ownership is a form of accountability.  Therefore, each risk item you identify should have a name assigned to manage or monitor the risk as part of his or her role on the project.  A brief review of the risk assessment matrix during project reviews can quickly indicate who may not be performing, as well as who may need help and support from the greater team.

Step 6: Quantify the Total Value of Each Risk

Once you’ve captured the risk items and examined how they may impact the project, it’s time to start putting numbers down.  In order to quantify the financial aspect of risks for a given project, we need to estimate the individual cost components and sum the value.   Treat each risk as its own project; estimating this value is no different that estimating scope for a new project.

To do this, look at each line of the risk matrix.  If it happens, what do you need to do?

  • How much more time is needed?
  • How many hours of effort are required?
  • What is the Hourly Rate of those resources?
  • What additional expenses (travel, materials, supplies) are there?

Tally up your assumptions in your risk matrix to compute the total.  Here is an example of what this conversation may look like for a commercial construction company:

Calculating Total Value of a Risk for a Construction Company:

“Risk #2.  The customer does not like their choice of paint color after the first coat.  … If the customer changes their mind after we finish painting the first coat, that’s going to be a two-week delay.  With 4 people on the project, at $20/ hour of cost, and 40 hours a week, that’s: 2 x4 x20 x40 = $6,400 of cost.”

Step 7: Estimate the Probability

The probability estimate is the percent chance of likelihood that the risk will occur.  For something you feel is likely, but not certain, you may wish to assign a probability of 60%.  For something that’s unlikely, but still something that may be of interest, you may elect to assign a probability of just 15%.

Go through each item in the risk assessment matrix with the project team and assign probability.

Step 8: Calculate the Expected Value of Each Risk

Once you have the total cost (Step 6) and the probability (Step 7) of each risk, we need to calculate their expected value, or predicted value.  To do this, multiply the cost value from Step 6 with the probability value in Step 7.

RELATED: Project Estimating in 3 Steps

Returning to the example of a commercial construction company, whose client may choose a different paint color:

Calculating Expected Value of a Risk for a Construction Company:
“For Risk #2, we calculated the cost of changing the paint color after the first coat to be $6,400 in Step 6.  Though unlikely, it does happen from time to time so we assigned a probability of 30% to this risk in Step 7.  Therefore, the expected value is $6,400 x 30% = $1,920.”

Step 9: Sum the Total Risk of the Project

Having calculated the expected value of each risk, it’s time to compute the total cost of risk for the entire project.  You can do this by simply adding all values in your risk assessment matrix that were generated as part of Step 8.  The total of these values represents the predicted cost, or weighted sum, of risk that you foresee with the project.

This predicted cost value is extremely important to a project’s financial model.  At the beginning of a new program, we can include this cost into the initial business case as part of the up-front investment.  Should some items in your risk log be realized over time, the anticipated costs of the risk items will already be included in the financial model of the project.  While you certainly want to mitigate risks from happening, you also want to be realistic and plan for some amount of them to occur.  Doing so ensures you build a realistic financial model and a healthy business case.

Step 10: After Your Risk Matrix is Made…

The final step in the generating a Project Risk Matrix is to schedule periodic follow-up reviews of it with your team.  Keep in mind that the risk assessment matrix you created to build the initial business case is also a tool that helps you manage risk for your project over time.  Reviewing it on a regular basis will drive the project team to evaluate each risk and modify any of your assumptions over the course of the project.  Here are some questions to ask during regular project team meetings:

Questions to Ask When Reviewing Your Risk Assessment Matrix:

  • Have any of the risks become real?
  • Have any of the risks been eliminated?
  • Have the probabilities of any risks changed?
  • Are your plans for mitigation still appropriate?
  • Are there any new risks that should be added to the list?

As the project progresses, evaluate the risk items, the cost values and their probabilities.  A risk that is realized should have a probability changed to 100% to reflect the cost will be incurred.  Items that are minimized or eliminated, should have their probabilities reduced.

Final Points on Creating a Risk Assessment Matrix

Every project and initiative comes with a set of risks.  A key responsibility of the project team, therefore, is to identify these risks and place a value on them that can be factored into the project’s cost model.

Over time, the predicted financial cost of risk for a project will change, but by going through the exercise of conducting an initial risk evaluation early on, you are well on your way to managing issues and concerns as they arise.  Having a well-built risk matrix will also ensure you are in a position to absorb financial impact of the issues your foresee.


Looking for More on Project Management?  You Might Like…

16 Tips for New Project Managers

Demystify Project Estimating With These 3 Steps

How to Justify Hiring More Staff


Leave a Reply

Your email address will not be published. Required fields are marked *