Framework library · Risk management and assessment
Risk heat map
A heat map shows a whole portfolio of risks on one grid, coloured by rating. Plotting each risk twice, at its inherent position with no controls and at its residual position with the controls that exist today, turns the picture into a test of the controls. Long arrows show controls doing real work, and short ones show where the business has nothing that reduces the risk.
Use it when
- A board or risk committee needs one picture of the top risks, not a forty-row register.
- You want to show whether controls actually reduce the risks they are meant to, and by how much.
- Money for controls is being allocated and you want to see which risks would move most.
- You report risks each quarter and want the movement since last time to be visible.
Avoid it when
- The scales behind the scores are not defined. Calibrate them with a risk matrix first, or the map shows guesses in colour.
- You need to record actions, owners and dates. That is the risk register; the heat map is a view of it.
- You need to decide how much risk each category may carry. That is risk appetite, set through enterprise risk management.
- The risks share causes or make each other worse. A map shows each risk alone. Use a bow tie or scenario planning to see how they combine.
How to run it
Start from a scored register
Six to twelve risks the board should see, each written as cause and effect, with an owner.
Score each risk with no controls
Inherent likelihood and impact: what would happen if the controls in place today were removed. This shows how much the business depends on them.
List the controls in place today
Only controls that exist and have been seen to work. Planned controls belong in the action plan, not in the residual score.
Score each risk with those controls
Residual likelihood and impact, on the same scales. Most controls lower either likelihood or impact; few lower both by much.
Read the arrows
Each arrow runs from the inherent position to the residual one. Long arrows show controls worth assuring. Short or missing arrows on hot risks show where nothing reduces the risk.
Decide what goes to the board
Residual high and critical risks, and any risk whose controls have not been tested, each with an action and an owner.
Work through it
Answer the questions below, or load the worked example to see a finished one. The drawing updates as you type. Export the result as a PowerPoint deck, a Word document, an Excel workbook, a PDF or plain text.
What you type stays in this browser, so you can close the page and come back to it. It is not sent to Blue Prysm or anyone else, and the exports are made here, on your device. Privacy policy.
Mistakes to avoid
- Scoring inherent risk as the current position. Inherent means without controls. If the two scores are always close, either the controls are weak or the inherent scores are understated.
- Counting planned controls in the residual score, which turns risks green before anything has been done.
- Treating the colour as the decision. Two risks in the same red cell can differ tenfold in money. Read the register behind the map.
- Showing residual positions only. A map without the arrows hides how much depends on controls that might fail.
Where it comes from
No single originator. The heat map is the likelihood and consequence matrix described in IEC 31010:2019, Risk management: Risk assessment techniques, used to display a portfolio rather than to score one risk. COSO's Enterprise Risk Management: Integrating with Strategy and Performance (2017) uses heat maps to depict risk and distinguishes inherent risk from target and actual residual risk; its record of public comments notes the criticism that heat maps show risks apart from the performance they affect. Source.
Use it with
Work through it with us
The frameworks here are free to use as they stand. If you would rather work through the question behind this one with us, these are the ways an engagement starts.