# How to Read a Risk Heat Map (5x5 Risk Matrix Explained)

> A risk heat map plots likelihood against impact so a committee can see exposure at a glance. What the bands mean, how inherent and residual risk differ on the same map, and the mistakes most people make reading one.

_Published 2026-10-05 · Risk · XGRC® Software_

Almost every risk committee pack has one: a grid of coloured boxes, usually red, amber and green, with risks plotted somewhere across it. Most people in the room can tell that red is bad and green is good. Far fewer can actually read the map, pick out a specific risk, or explain why it moved from one cell to another between reporting cycles. That gap matters, because a heat map that nobody can properly interrogate just becomes wallpaper.

## What a Risk Heat Map Actually Shows

A risk heat map plots risks against two axes: how likely they are to happen, and how severe the consequences would be if they did. The standard version is a 5x5 grid, with likelihood running along one axis and impact along the other, each scored from 1 (lowest) to 5 (highest). Multiply the two scores together and every risk lands somewhere between 1 and 25.

That number is the risk score, and it is what the colour of each cell represents. A risk rated likelihood 2, impact 2 scores 4 and sits in a pale corner of the grid. A risk rated likelihood 5, impact 5 scores 25 and sits in the deep red corner. The map is really just a visual shortcut for that multiplication, built so a committee can scan twenty or more risks in a few seconds instead of reading twenty rows of a spreadsheet.

## Reading the Bands

Most organisations group the 1 to 25 score range into four bands, though the exact cut-offs vary by risk appetite and industry:

- Low (1-5): accepted as part of normal operations, monitored but rarely escalated
- Moderate (6-11): tracked by the risk owner, reviewed at department level
- High (12-19): reported to senior management, usually with an active treatment plan
- Critical (20-25): reported to the board or risk committee, with an owner and a deadline

These bands are a convention, not a law of nature. What matters more than the exact numbers is that everyone reporting into the same pack uses the same scale, so a "high" risk in operations means the same thing as a "high" risk in IT.

## Inherent vs Residual Risk on the Same Map

The most useful heat maps show two versions of the same risk set side by side: inherent risk, which is the exposure before any controls are applied, and residual risk, which is what remains after controls, mitigations and existing safeguards are taken into account.

Plotting both tells you something a single map cannot. A risk that starts in the critical zone and ends up moderate after controls shows that the control environment is actually doing its job. A risk that starts high and stays high despite a long list of documented controls is a much more useful thing for a committee to see than either map on its own, because it points straight at a control that is not working, not just a risk that exists.

For example, a risk rated likelihood 5, impact 4 inherently (score 20, critical) might drop to likelihood 2, impact 2 residually (score 4, low) once multi-factor authentication, monitoring and an incident response plan are factored in. If the residual score barely moves from the inherent one, that is usually the more important finding than the raw risk itself.

## Common Mistakes When Reading a Heat Map

- Treating the grid position as precise. A score of 12 and a score of 15 both sit in "high", and the difference between them is rarely meaningful enough to argue over. The band matters more than the exact cell.
- Comparing heat maps built on different scales. A 3x3 matrix and a 5x5 matrix are not interchangeable, and neither are two 5x5 matrices with different band cut-offs.
- Only looking at residual risk. A residual-only map can hide a risk where the controls are doing enormous work to keep a very large inherent exposure under control, which is exactly the kind of single point of failure a committee should want visibility of.
- Assuming the likelihood score is objective. Without decent incident, loss and near-miss data behind it, a likelihood rating is often someone's informed judgement rather than a measured frequency, and that is worth stating openly rather than presenting it as harder data than it is.

## What a Well-Reconciled Heat Map Should Do

The number of risks plotted on the map should match the number of risks on the register behind it, for both the inherent and residual versions. If a heat map shows nineteen risks and the register lists twenty-three, something in the reporting pipeline is dropping or double-counting records, and that is a data quality problem a committee should ask about directly.

The clearest way to see this in practice is to look at a live example rather than a static picture. XGRC®'s [IT Risk & Performance Committee dashboard](https://xgrcsoftware.com/tour/it-risk-performance.html) plots inherent and residual risk on matching 5x5 heat maps side by side, with the risk count behind each half stated explicitly so the reconciliation is visible, not assumed. It is one of seventeen interactive examples in the full [XGRC® dashboard tour](https://xgrcsoftware.com/tour/), each built on fictitious data so you can explore freely.

## Frequently asked questions

### What is a 5x5 risk matrix?

A 5x5 risk matrix is a grid that plots risks by likelihood (1 to 5) and impact (1 to 5), multiplied together to give a risk score from 1 to 25. It is the most common way to visualise and compare risks across an organisation at a glance.

### What do the colours on a risk heat map mean?

Colours represent risk score bands, typically low (1 to 5, green), moderate (6 to 11, yellow or amber), high (12 to 19, orange) and critical (20 to 25, red). The exact cut-offs vary by organisation and risk appetite, but the same scale should be used consistently across every risk reported into one pack.

### What is the difference between inherent and residual risk?

Inherent risk is the exposure before any controls are applied. Residual risk is what remains after controls, mitigations and existing safeguards are taken into account. Plotting both on matching heat maps shows whether controls are actually reducing exposure, not just whether a risk exists.

### How is a risk score calculated on a heat map?

Risk score is calculated by multiplying the likelihood rating by the impact rating, each scored 1 to 5, giving a result between 1 and 25. That score determines which band, and therefore which colour, the risk falls into on the map.

---

Source: https://xgrcsoftware.com/insights/how-to-read-a-risk-heat-map