A quality risk matrix combines selected categories, commonly consequence and likelihood, to support discussion and prioritisation. It can provide a consistent visual framework, but the resulting colour or score is not an objective fact independent of definitions, evidence and judgement.
The risk-based thinking guide explains the wider decisions. A matrix is an optional method. It should not be presented as a universally mandatory ISO 9001 tool or a substitute for relevant technical evaluation.
Define what the matrix is intended to support
Identify the type of decision, process scope and consequences being considered. A matrix designed for a broad portfolio may be too coarse for a specific operational control decision.
Decide whether it helps initial screening, prioritisation or another purpose. Do not assume that one colour authorises every decision, especially where an applicable requirement or significant uncertainty needs separate consideration.
The method should fit the information available. A detailed numerical scale can create false confidence when participants have little evidence for distinguishing its categories.
Define the categories and basis
Explain what consequence categories mean in the relevant context. Distinguish customer disruption, unsuitable output and other effects where those differences matter. Avoid combining unlike consequences without explaining the decision rule.
Define likelihood in relation to an event and period or operating condition. Likely is ambiguous if one participant means during the next job and another means during several years of operation.
| Matrix element | Question to resolve |
|---|---|
| Consequence | Effect on which result, requirement or recipient? |
| Likelihood | Under which conditions and time basis? |
| Existing controls | What protection is assumed and evidenced? |
| Uncertainty | Which assumptions could change the assessment? |
| Decision rule | What action or further enquiry follows? |
These are design questions, not a prescribed scale or universal scoring formula.
Preserve the underlying information
Record the event, effect, controls and evidence alongside the rating. Two situations in the same cell may need different responses because their consequences, control dependencies or uncertainty differ.
An infrequent event with a serious consequence should not disappear behind a moderate combined number without suitable consideration. Conversely, a frequent minor inconvenience may deserve improvement for reasons different from a consequential control failure.
The risk assessment examples show how a clear narrative supports the decision. A matrix should organise that reasoning rather than replace it.
Recognise numerical limitations
Categories are not always measured quantities with equal intervals. Multiplying ordinal labels can produce an apparently precise ranking that depends heavily on arbitrary definitions.
Do not interpret small score differences as proof of a meaningful difference without a basis. A change from one category to another may reflect new information or a different judgement rather than an exact change in exposure.
Where more detailed analysis is needed, identify the question and obtain suitable expertise or evidence. Adding more colours does not necessarily improve the decision.
Connect ratings with authority and action
Define who can make or review the decision and what happens after screening. A red cell without ownership or a response route provides limited practical control.
A low rating cannot cancel an applicable customer, legal or other obligation. Assess the requirement separately from the organisation’s chosen prioritisation method.
The risk evaluation and treatment article explains why selecting a response is a further decision, not an automatic consequence of a number.
Review controls before changing the rating
If an action is proposed, distinguish expected benefit from demonstrated implementation and effectiveness. Do not lower a rating solely because the action has an owner or due date.
Test whether the control addresses the relevant event under the conditions that matter. Multiple checks can rely on the same weak input or share a common bypass.
Preserve important assumptions and identify evidence needed for review. A matrix can help communicate a current view while the narrative records what remains uncertain.
Evaluate whether the matrix is useful
Compare its outputs with real decisions and later experience. Does it identify consequential issues and support proportionate action, or does discussion concentrate on obtaining a preferred colour?
Review definitions when scope, processes or obligations change. Avoid comparing historical scores as though the method and operating conditions remained identical when they did not.
A useful matrix makes judgement more transparent and consistent. Its limitations should remain visible, with decisions grounded in requirements, evidence and suitable authority rather than confidence created by arithmetic or colour alone.
When several people assign ratings, compare their interpretation of the definitions using a relevant example. Agreement on the number alone may conceal different assumptions about the event or period. Resolve those differences before combining or ranking entries. A consistent method should make the reasoning clearer rather than merely make the colours match.
Review borderline assessments deliberately. If moving one category would change the required approval, ask whether the available evidence supports the distinction. The answer may be to gather more information or to choose a response robust to both interpretations. Recording this sensitivity is often more helpful than debating which single square is absolutely correct when the underlying observations are incomplete.