A risk matrix: likelihood and impact

When people talk about risk, you often hear "that is very dangerous" or "not so bad", but such judgements are subjective and turn into arguments in discussion. A risk matrix puts these opinions into a common language: each risk gets two numbers, and their product shows which problem to tackle first. You can build one in Excel in an hour or two.

Two axes: likelihood and impact

Likelihood goes on the horizontal axis and impact on the vertical. Rate both from 1 to 5. What matters is to write down in advance what each score means, otherwise everyone reads it differently. A sample scale (adapt it to your own warehouse):

• Likelihood: 1 — less than once a year; 2 — once or twice a year; 3 — every quarter; 4 — monthly; 5 — weekly or more often.
• Impact: 1 — loss under 1 million so'm; 2 — 1–10 million; 3 — 10–50 million; 4 — 50–200 million; 5 — over 200 million so'm, or loss of a customer, a licence or reputation.

Do not measure impact in money alone. A two-day halt in deliveries or medicines going past their expiry date can have graver consequences than the loss in so'm.

Filling in the matrix step by step

1. List the risks: at least 10–15 across receiving, storage, picking, returns, write-offs, the accounting system and physical security.
2. Put each on its own row: description, cause and consequence.
3. Assign likelihood and impact scores. Do it together with the warehouse manager, a finance person and a forwarder.
4. Multiply the two scores to get the overall risk level (1 to 25).
5. Look at the existing controls and assess the residual risk after they are taken into account.
6. Split the results into colours.

Residual risk is the danger that remains after controls. For instance, manual stock adjustment with no control scores 4 × 4 = 16. If a second signature and a monthly report to the manager are introduced, likelihood falls to 2 and the residual risk is 8. This way the value of each control shows up in a number.

Examples

• A delivery not counted at receiving: likelihood 4, impact 3, total 12 — high.
• Stock adjusted with no control: likelihood 4, impact 4, total 16 — very high.
• A shelf of expensive goods left unlocked: likelihood 2, impact 5, total 10 — medium, but with a large impact.
• Fire: likelihood 1, impact 5, total 5 — looks low, yet a fire-suppression system and insurance are essential.
• Damaged packaging: likelihood 5, impact 1, total 5 — constant, but cheap.

The last two examples have the same score yet need completely different responses. The matrix supports decisions; it does not replace the auditor's judgement.

Zones and what to do in each

Typically 1–6 points is the green zone: monitoring is enough. 7–14 is yellow: strengthen controls according to plan. 15–25 is red: act immediately and check first in the audit. Flag any risk with an impact of 5 separately even if the product is small, because for a large loss a single occurrence is enough.

The matrix should turn into an audit plan. For each risk in the red zone, write concrete testing steps: which documents to pull, what count to run, whom to interview. For stock adjustments that scored 16, for example: export every adjustment entry for the last 6 months from 1C, compare the 10 largest with their source documents and find out who keeps entering them again and again.

Common mistakes

• Setting scores by feel and not writing down the scale.
• Filling in the matrix once and putting it in a drawer: risks keep changing.
• Rating only "what error is possible" and not "would the existing control catch it".
• Colouring everything red, which destroys the priority.

Conclusion

A risk matrix is not complicated, yet it answers the manager's question "where do we start?" with numbers. OmborAudit starts its audit plan with exactly this kind of assessment.