QULDEXResources · Glossary
What is a risk heatmap? How to read and build one
What does a risk heatmap show?
Each risk has a likelihood score and an impact score. The heatmap places the risk in the cell where the two meet, and the colour of that cell shows whether it is low, medium, high or critical.
The value is in the definitions behind it. If 'likely' and 'major' are not defined, two assessors will place the same risk in different cells and the picture means little.
What do you need to build one?
Defined levels, for example from rare to almost certain, each with a description.
Defined levels for the consequences that matter: financial, legal, operational, reputational.
Which cells are low, medium, high and critical, and which need treatment.
How do you read a heatmap?
Three risks on a 5 by 5 matrix.
| Risk | Position and meaning |
|---|---|
| Leaver accounts not removed | Likelihood 4, impact 4: score 16, high. Treat now. |
| Data centre flood | Likelihood 1, impact 5: score 5, medium. Rare but severe; check continuity plans. |
| Minor website defacement | Likelihood 3, impact 1: score 3, low. Accept and monitor. |
This is an illustration written for this page, not a customer record.
What do standards say about risk matrices?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 6.1.2 | Risk criteria are established, and assessments produce consistent, valid and comparable results. No particular matrix is required. |
| ISO 31000 | Clause 6.4 | Risks are analysed and evaluated against criteria to decide which need treatment. |
| IEC 31010 | Techniques | Describes the consequence and likelihood matrix among other risk assessment techniques, with its limits. |
| NIST CSF 2.0 | ID.RA | Threats, vulnerabilities, likelihoods and impacts are used to understand risk and set priorities. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
Where do heatmaps mislead?
Undefined scales
Scores depend on who is in the room.
Instead: write a description for every level.
Same score, different risk
A rare catastrophe and a frequent nuisance get the same number.
Instead: look at likelihood and impact separately for severe risks.
False precision
A score of 12 is treated as meaningfully worse than 10.
Instead: use the bands, not the arithmetic.
How does QULDEX handle this?
Risks scored on your own matrix, each with an owner, a treatment and a review date, linked to controls and audits.
Risk Heatmap: common questions
Is a risk heatmap the same as a risk matrix?
In practice, yes. 'Matrix' usually refers to the grid and its scoring rules, and 'heatmap' to the coloured picture with risks plotted on it.
How is a risk score calculated?
Most often by multiplying the likelihood score by the impact score. Some organisations add them or use a lookup table. Whatever you choose, document it and apply it consistently.
What size should a risk matrix be?
Five by five is common because it gives enough separation without false precision. Three by three can work for smaller organisations.
Score risks on your own matrix
Controls, evidence, findings and corrective actions in one audit workspace.