A risk assessment matrix needs a declared context, separate likelihood and impact judgments, and a rule for combining them. An unknown rating belongs outside the grid until there is a basis for placing it. It should never become “low” because a field was left blank.
This fictional digital-exhibit example shows a three-by-three lookup, two supplied assessments, and one risk that cannot yet be placed. The categories are teaching judgments, not measured risks for a live project.
Define the context and labels first
The exercise covers one digital-exhibit upload cycle. Its impact categories refer to the published exhibit record:
| Impact | Meaning in this example |
|---|---|
| Low | A cosmetic fix without changing the record's meaning. |
| Medium | A correction affecting the working record before publication, without withdrawal or reissue of a published record. |
| High | A published-record problem requiring withdrawal or reissue. |
For this exercise, Low likelihood means a supplied assessment identifies a remote failure path with the relevant checks in place. Medium means a credible failure path remains partly controlled. High would mean a supplied assessment identifies a recurring or readily realizable failure path with key checks absent. These are descriptive categories, not probability percentages. A real team would need to agree its assessment basis and gather the information to apply them.
The NCSC's introductory method describes qualitative likelihood/impact matrices and emphasizes explaining their scales and uncertainty. The lookup below is our own teaching rule, not an NCSC-approved assessment or a copied universal scale. Read the method.
Declare how the grid combines the ratings
Read the likelihood row against the impact column:
| Likelihood ↓ / Impact → | Low | Medium | High |
|---|---|---|---|
| Low | Routine | Routine | Review |
| Medium | Routine | Review | Priority |
| High | Review | Priority | Priority |
Here, Routine means retain for routine review, Review means discuss the assessment and response, and Priority means bring it forward for a response decision. None means “safe,” “approved,” or “compliant.” The labels organize attention within this exercise.
Do not multiply Low, Medium, and High as though they were measured quantities. The displayed result comes from the declared table. Another organization's matrix could use a different rule, which is why the rule needs to travel with the ratings.
Follow the three example risks
| Risk | Supplied likelihood | Supplied impact | Result under this lookup |
|---|---|---|---|
| R1: wrong caption file associated with an image | Medium | High | Priority |
| R2: cosmetic display-font mismatch | Low | Low | Routine |
| R3: reviewer availability missing | Unknown | Medium | Not placed |
R1 uses the exercise's credible, partly controlled failure-path judgment and a consequence requiring withdrawal or reissue. R2 uses the supplied Low/Low judgment for a cosmetic correction. The worksheet demonstrates how those supplied assessments map to a result; it does not independently establish that the ratings are accurate.
For R3, the next useful question concerns reviewer availability and the basis for assessing its likelihood. Medium impact alone does not identify a cell. Keep the risk visible in an unplaced section with that missing information.
Keep a proposed control separate from its effect
The team proposes a peer cross-check of filenames for R1. It has not implemented or evaluated that check. Selecting the proposed-control view should therefore leave R1 at Medium/High, Priority.
The proposed residual assessment stays unassessed. To reconsider it later, the team would need to know how the check operates and what evidence supports its effect on the failure path. Writing a control in a text box does not establish either point.
Use the assessment view
Select R1 or R2 to highlight the labeled cell and trace the result back to the ratings and lookup. Select R3 to see why it remains outside the matrix. Open the proposed control to compare current assessment with the evidence still needed for a residual assessment.
In the blank worksheet, enter the scope, category definitions, assessment basis, and ratings together. Written labels accompany color so the result remains understandable without color cues. Keep notes across views, and confirm before resetting them.
Copy this prompt for a reviewable matrix
Create a complete self-contained HTML qualitative risk-matrix worksheet.
My scope: [activity/timeframe]. Category definitions: [likelihood and
impact meanings]. Combination rule: [explicit lookup]. Risk evidence:
[supplied judgments and limitations]. Unknowns must remain unplaced.
Include a separate fictional digital-exhibit upload-cycle case. Impact
Low=cosmetic fix without changing record meaning; Medium=working-record
correction before publication without published withdrawal/reissue;
High=published record requiring withdrawal/reissue. Likelihood Low=
supplied remote path with relevant checks; Medium=credible partly
controlled failure path; High=recurring/readily realizable path with
key checks absent. Descriptive training categories, not probabilities.
Against impact Low/Medium/High, lookup likelihood rows:
Low: Routine,Routine,Review; Medium: Routine,Review,Priority;
High: Review,Priority,Priority. Explain these attention labels do not
declare safety, approval, compliance, or universally acceptable risk.
R1 wrongcaptionfile associated withimage: suppliedMedium/High=Priority.
R2 cosmeticfontmismatch: suppliedLow/Low=Routine. R3 missingreviewer
availability: Unknown/Medium, outside matrix, not treated as Low.
Select risk to highlight cell and display its supplied basis/limits.
Proposed peer filename cross-check for R1 not implemented/tested:
current rating unchanged; residual unassessed. Ask for future evidence
without fabricating control effectiveness. No ordinal multiplication.
Add blank scope/definitions/evidence/rating fields, named missing-scope
feedback, notes retained across views/validation, confirmed reset.
Use written labels with color, keyboard-accessible controls, visible
focus, system fonts at least16px, 360px layout without horizontal
scrolling, inline CSS/JavaScript, no dependencies. Return complete HTML.
Review the meaning behind the cell
Share the prepared matrix in NOS with the person who owns the exhibit's publishing process. Ask whether “withdrawal or reissue” accurately describes the consequence they would need to manage. Clarifying that definition is more useful than moving the same unexplained label to a different colored square.