Risk Heat Maps and Scoring Methodologies

Risk Heat Maps and Scoring

Purpose of Heat Maps

Risk heat maps provide a visual representation of risk assessment results, enabling quick understanding of risk distribution and prioritization.

Designing Effective Scales

Likelihood Scale (5-Point)

| Score | Level | Definition | |-------|-------|------------| | 1 | Rare | <5% chance, once in 10+ years | | 2 | Unlikely | 5-20% chance, once in 5-10 years | | 3 | Possible | 20-50% chance, once in 2-5 years | | 4 | Likely | 50-80% chance, once in 1-2 years | | 5 | Almost Certain | >80% chance, expected annually |

Impact Scale (5-Point)

| Score | Level | Financial | Reputation | Regulatory | |-------|-------|-----------|------------|------------| | 1 | Insignificant | <$10K | No coverage | Minor breach | | 2 | Minor | $10K-$100K | Local news | Warning letter | | 3 | Moderate | $100K-$1M | Industry coverage | Formal action | | 4 | Major | $1M-$10M | National news | Sanctions | | 5 | Catastrophic | >$10M | International news | License loss |

Creating the Heat Map

Traditional 5x5 Matrix

Impact ↑
5 | 5  10 15 20 25
4 | 4   8 12 16 20
3 | 3   6  9 12 15
2 | 2   4  6  8 10
1 | 1   2  3  4  5
    1   2  3  4  5 → Likelihood

Color Coding

• Green (1-4): Low risk, accept
• Yellow (5-9): Medium risk, monitor
• Orange (10-15): High risk, mitigate
• Red (16-25): Critical risk, immediate action

Alternative Approaches

Asymmetric Matrices

Use when certain impacts are more significant:

• 5x7 matrix for financial services
• Custom weighting for strategic risks

Multi-Dimensional Assessment

• Velocity (speed of onset)
• Vulnerability (susceptibility)
• Persistence (duration of impact)

Best Practices

• Calibrate scales to your organization
• Train assessors for consistency
• Document rating rationale
• Show movement over time
• Include both inherent and residual
• Avoid clustering in the middle