Semi-Quantitative Risk Matrix Analysis
Also known as: Risk Matrix Analysis, Consequence-Likelihood Matrix, Probability-Impact Matrix, Risk Rating Matrix
Semi-quantitative risk matrix analysis rates each risk on ordinal likelihood and consequence scales and combines the two in a grid to assign a risk level that drives prioritization. It is the workhorse of practical risk management: ISO/IEC 31010 lists the consequence-likelihood matrix among its standard techniques precisely because it lets analysts compare many disparate risks quickly without the data demands of a full quantitative model. The 'semi-quantitative' label captures its hybrid character — ordinal categories such as 'rare' or 'catastrophic' are anchored to rough numeric bands, giving more discipline than a purely verbal judgment but far less than a probabilistic calculation. The method's popularity is matched by sharp critique: L. A. Cox's 2008 analysis in Risk Analysis showed that poorly designed matrices can rank risks incorrectly, compress very different risks into the same cell, and even perform worse than random, making careful scale design and consistency checks essential rather than optional.
Key highlights
- Fast and inexpensive, allowing many heterogeneous risks to be compared and ranked in a single session.
- Accessible to non-specialists and easy to communicate, with color-coded cells that convey priority at a glance.
- More disciplined than purely verbal judgment because each scale level is anchored to a quantitative band.
- Works as an effective triage layer, identifying which risks are acceptable and which warrant deeper quantitative study.
Intuition
This section is available to Pro members. Upgrade to Pro
How it works
This section is available to Pro members. Upgrade to Pro
When to use it
Use a semi-quantitative risk matrix when you must screen and prioritize many risks quickly, communicate relative risk to non-specialists, or work in settings where full quantitative data are unavailable. It is well suited to early-stage hazard reviews, routine operational risk registers, and as a triage layer that decides which risks merit deeper probabilistic analysis. The method is appropriate when likelihood and consequence can be banded credibly and when an ordinal ranking is sufficient for the decision. It is poorly suited to fine-grained choices among similar high-stakes risks, to risks with negatively correlated frequency and severity, or to any case where the absolute magnitude of risk matters, because Cox showed matrices can mis-rank and compress such risks. In those situations a quantitative or probabilistic assessment should replace or supplement the matrix.
Strengths & limitations
- Fast and inexpensive, allowing many heterogeneous risks to be compared and ranked in a single session.
- Accessible to non-specialists and easy to communicate, with color-coded cells that convey priority at a glance.
- More disciplined than purely verbal judgment because each scale level is anchored to a quantitative band.
- Works as an effective triage layer, identifying which risks are acceptable and which warrant deeper quantitative study.
- Only yields ordinal risk levels, so it cannot express how much one risk exceeds another or support fine comparisons.
- Cox showed poorly designed matrices can rank risks incorrectly and even perform worse than random assignment.
- Range compression places quantitatively very different risks in the same cell, hiding real differences in severity.
- Ratings are sensitive to subjective interpretation of scales and to the placement of category boundaries, which encode hidden risk-appetite choices.
Common pitfalls
This section is available to Pro members. Upgrade to Pro
Applications
This section is available to Pro members. Upgrade to Pro
Frequently asked
What makes a risk matrix 'semi-quantitative' rather than qualitative?
A purely qualitative judgment uses words like 'low' or 'high' with no numeric meaning. A semi-quantitative matrix anchors each ordinal level to a quantitative band — a frequency range for likelihood and a monetary or impact range for consequence — so the categories carry approximate numeric content. This anchoring, emphasized in ISO/IEC 31010, gives more discipline and comparability than verbal scales while stopping short of computing an actual probability or expected loss, which is the province of fully quantitative methods.
Are risk matrices reliable, given Cox's critique?
They are reliable for what they are designed to do — fast screening and ordinal ranking — provided they are built carefully. Cox showed that badly designed matrices can rank risks in the wrong order, compress very different risks into one cell, and perform worse than random for risks with negatively correlated frequency and severity. The remedy is not to abandon the tool but to design scales and cell colorings that satisfy weak consistency, avoid range compression, and to escalate closely ranked or high-stakes risks to quantitative analysis rather than relying on the grid.
How many likelihood and consequence levels should a matrix have?
There is no universal answer, but the number of levels trades discrimination against false precision. Too few levels compress distinct risks together; too many imply a precision the underlying judgments cannot support and can introduce ordering inconsistencies. ISO/IEC 31010 leaves the choice to the user but stresses anchoring each level to a defined band. In practice three-by-three to five-by-five grids are common, and the design should be checked against consistency criteria rather than chosen by habit, since the level count directly affects whether the matrix can rank risks correctly.
Sources
- 1.International Organization for Standardization. (2019). IEC 31010:2019 Risk management — Risk assessment techniques. ISO/IEC, Geneva.
- 2.Cox, L. A. (2008). What's Wrong with Risk Matrices? Risk Analysis, 28(2), 497-512.
You have read it. What now?
Cite this page
ScholarGate. (2026, June 23). Semi-Quantitative Risk Matrix Analysis. ScholarGate. https://scholargate.app/disaster-studies/semi-quantitative-risk-matrix