Risk Matrix and Heat Map: How They Are Built, Step by Step

The two tables your supervisor asks to see, explained with a worked example.

Talk to us on WhatsApp See every service

A risk matrix crosses two scales and gives a level in each cell. The first crosses the probability of a risk event with its impact and gives the inherent risk. The second crosses that inherent risk with the rating of the controls and gives the residual risk. Painted by colours, with each event in its cell, it is the heat map.

Two Matrices, Two Questions

The law asks for both, and neither replaces the other.

The client risk matrix

How risky is this client? Each factor (country, activity, product, channel, PEP status) has a weight, the weights add up to 100 %, and the result places the client in a level that sets its due diligence and how often it is reviewed.

The entity risk matrix

How could someone use my business? It measures risk events by probability and impact, rates the controls that mitigate them, and consolidates the residual risk by factor and for the entity as a whole.

The heat map

The matrix of the entity painted by colours, with each event placed in its cell. At a glance, the board sees which events sit in red and need a plan.

The Scales

Everything starts with scales that your methodology defines. Four levels is the most common choice; this guide uses four.

Swipe the table sideways to see every column.

Level	Probability	Impact	Control rating
1	Low: rare, few clients or operations involved	Low: minor and quickly corrected	Good
2	Medium-low: possible	Medium-low: noticeable, without a sanction	Adequate
3	Medium-high: likely	Medium-high: a sanction, a claim or a loss of clients	Improvable
4	High: frequent, many clients or operations	High: serious harm to the entity	Deficient

In the control scale a higher number is a worse control. Each scale says how it is measured: probability with a count or a percentage of clients, alerts or operations in a period, impact on each associated risk.

The Two Heat Maps

Read a cell where a row and a column meet. In these examples each cell is the average of the two levels, rounded up; your methodology can fill each cell its own way.

Inherent risk: probability by impact

The risk of an event before any control. An event of medium-high probability (3) and high impact (4) is a high inherent risk.

Illustrative inherent risk matrix
Probability	1 Low	2 Medium-low	3 Medium-high	4 High
4 High likelihood	3 Medium-high	3 Medium-high	4 High	4 High
3 Medium-high likelihood	2 Medium-low	3 Medium-high	3 Medium-high	4 High
2 Medium-low likelihood	2 Medium-low	2 Medium-low	3 Medium-high	3 Medium-high
1 Low likelihood	1 Low	2 Medium-low	2 Medium-low	3 Medium-high

Columns: impact. Rows: probability, from high at the top to low at the bottom.

Residual risk: inherent risk by control rating

What remains after the controls. A high inherent risk (4) with an improvable control (3) stays high; the same risk with a good control (1) falls to medium-high.

Illustrative residual risk matrix
Inherent risk	1 Good	2 Adequate	3 Improvable	4 Deficient
4 High	3 Medium-high	3 Medium-high	4 High	4 High
3 Medium-high	2 Medium-low	3 Medium-high	3 Medium-high	4 High
2 Medium-low	2 Medium-low	2 Medium-low	3 Medium-high	3 Medium-high
1 Low	1 Low	2 Medium-low	2 Medium-low	3 Medium-high

Columns: control rating. Rows: inherent risk. A better control (to the left) lowers the residual risk.

Discrete, Continuous or Arithmetic

Three common ways to obtain the residual risk. The methodology chooses one, and it is approved with it.

Discrete matrix

Whole levels only: the cell where the inherent level and the control rating meet gives the residual level. It is the one shown above, and the easiest to read for a board.

Continuous matrix

Each level divided into quarters (3.25, 3.50, 3.75…). It shows movement inside a level: a residual of 3.25 is still high, but close to medium-high.

Arithmetic

An average or a weighted average of the inherent risk and the control rating, without a table. The result is turned into a level with the same scale.

A Worked Example

One event, from its probability to the plan, with the conservative rounding: a figure with decimals rises to the next level.

The event

Clients who pay in cash amounts that do not match their declared activity.

Probability: 3

18 % of the clients paid in cash in the period. The methodology places 15 % to 25 % in level 3, medium-high.

Impact: 3

Reputational 4, legal or compliance 3, operational 2, contagion 2. The average is 2.75, which rises to 3.

Inherent risk: 3

Probability 3 and impact 3 meet in the medium-high cell of the inherent risk matrix.

Controls: 3

Two controls: a cash limit rated 2 and a review of the source of funds rated 3. The average is 2.5, which rises to 3, improvable.

Residual risk: 3, and the plan

Inherent 3 and control 3 give a medium-high residual. If the methodology asks for additional actions from medium-high, the event goes to the strengthening plan.

How COX Builds Them

Your methodology sets the scales and the cells; COX computes and places each event.

Computed, never typed

At a cut-off date COX computes the probability, the impact, the inherent risk, the rating of the controls and the residual risk of each event. The same data always gives the same map.

Probability counted from your files

PEPs, foreign nationals, legal entities, high-risk clients, countries on the FATF lists and non-face-to-face channels are counted from the files you already have in COX.

Each event in its cell

The heat map places each event by its inherent risk and its control level. Events without controls go apart, and those that could not be computed are named, never dropped.

Rounded up, the conservative reading

A figure with decimals rises to the next level: a 2.1 is already level 3. For the combined rating of several controls, the methodology chooses up or nearest.

Controls rated with their tests

A control is rated by whether it is documented, preventive or detective, how often it runs, and the compliance and effectiveness its registered tests measured.

In the report and in Excel

The same heat map goes in the sealed report to the board, and the matrices are exported to Excel. An empty figure stays empty: the map never shows a zero that nobody measured.

Frequently Asked Questions

A risk matrix painted by colours, from green for low to red for high, with each risk event in the cell of its levels. It shows at a glance where the risk concentrates and which events need additional actions.

The methodology decides. Four levels avoid a middle level where everything ends up; five give more detail. What matters is that each level is defined and that the same scale is used from the event to the entity.

The discrete matrix is easier to read and to explain to a board. The continuous one, in quarters, shows the movement of a risk inside its level from one assessment to the next. Both are valid if the methodology says which one it uses.

Because it is the conservative reading: a risk of 2.1 has already passed level 2. Rounding down would show a risk smaller than the one measured.

COX offers a reference to start from, with scales, methods, weights and a residual matrix, that you adapt to your business. The methodology is your entity's and your board approves it.

Build Your Heat Map From Your Own Files

Open your account: the methodology starts from a reference, and the assessment counts from the clients you already have.