Risk heat map

Category: Risk management frameworks · Reviewed by Apex Insurance Brokers · Last reviewed

A risk heat map is a graphical representation of a risk register, plotting risks on a grid of likelihood (x-axis) against impact (y-axis) with colour-coding (typically green / amber / red) to indicate severity. It is the most common board-level reporting tool for risk.

Strengths

• Rapidly communicates the relative severity of many risks.
• Surfaces concentrations (multiple risks in the red zone).
• Supports tracking inherent vs residual positions through arrows.

Limitations

Heat maps are a useful summary but a poor analytical tool:

• They compress probability distributions to a single point.
• They invite arithmetic comparison of risks measured on different units.
• They obscure correlation between risks.
• Researchers (notably Tony Cox, 2008) have shown that ordinal heat maps can produce decisions inconsistent with expected loss.

For analytical work, supplement heat maps with Monte Carlo simulation, bowtie analysis or value-at-risk measures.

Design tips

• Use logarithmic impact scales (£10k, £100k, £1m, £10m, £100m+) rather than linear ones.
• Specify likelihood bands as time-bounded probabilities (“once every 25 years” / “10% in any year”), not vague labels (“possible”).
• Show arrows from inherent to residual positions so the value of controls is visible.
• Always pair the map with the underlying register entries.

References

• IEC 31010:2019, Section B.9 (Consequence/probability matrix).
• Cox, L.A. (2008). What’s Wrong with Risk Matrices? Risk Analysis 28(2).
• ISO 31000:2018.

Cross-references

• Risk register
• Risk matrix
• Likelihood and impact scoring

Maintained by Apex Insurance Brokers. FCA FRN 724952. Companies House 07014570.