Risk Heat Map

A board faces a long list of operational risks, and a heat map can show which assessed scenarios fall into higher or lower zones so leaders can discuss them. It should point back to detailed records, not replace the evidence behind each dot.

Write each risk as a scenario: 'Cyber' is too vague, whereas 'a ransomware attack stops order processing for three days' says what event and consequence are being assessed. Define likelihood over a time period, because 'possible' could mean within twelve months or within ten years, and use a shared scale with descriptions, data and assumptions so teams do not score similar events in incompatible ways.

Define impact against business objectives, since financial loss, safety, customer harm, legal exposure and service interruption may all matter. A small cash loss with serious safety consequences should not automatically be coloured green.

Many maps use a five-by-five grid in which a row or column represents one level of likelihood or impact. Some firms multiply 1-to-5 scores while others use a policy-defined combination, but these numbers are ordinal categories, not precise probabilities.

Colour conventions vary, with red often signalling an escalation or prompt response, amber a review and green routine monitoring, and a colour only means what the organisation's thresholds and risk appetite say it means, so include a legend. A high-likelihood, low-impact event and a low-likelihood, high-impact event can yield the same simple score, yet they may need very different responses, so read the scenario and potential severity before allocating money by colour alone.

A map also does not calculate expected loss merely because scores are multiplied: a likelihood category of four and impact category of five yield 20 on a chosen ordinal scale, not a 20% chance or a $20 million loss. NIST's enterprise-risk guidance notes that prioritisation is informed by the organisation's strategy and more than a raw exposure number, and it also discusses visualising priorities, which supports the point that a coloured cell is not the final decision.

Distinguish risk before controls from risk after controls: a warehouse fire may have a high inherent impact but lower residual likelihood after alarms and suppression, so show which view the map displays and whether a proposed control is already implemented. Record uncertainty too, because a likelihood estimate based on three incidents is not as reliable as a well-observed process failure rate, and mark low-confidence assessments or use a range so a bright colour does not create false certainty.

Link each map item to a risk register that identifies owner, cause, impact, controls, assessment date and response, since a map with anonymous dots makes it harder to move from discussion to action. Review changes over time, because a supplier's financial condition can worsen and a new regulation can raise impact, and update the map when new evidence appears, not only at the next annual board meeting.

Pair the map with action: for each priority risk, decide whether to reduce, transfer, accept or avoid it, with an owner and review date. For an owner, a risk heat map helps start a focused conversation, so define scenarios and scales, preserve the records behind the colours and use judgement about consequences before setting the response; a board presentation that changes no response is only a picture.