Lion Cipher Lab
Measure what a 5x5 risk matrix gets wrong
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
The 5x5 risk matrix (likelihood 1 to 5, impact 1 to 5, multiply, colour the cell) is the most widely used risk-scoring tool in security and compliance. It is quick and easy to explain, and it decides which risks get budget. It also has known, measurable weaknesses. In 2008 the risk analyst Louis Anthony Cox published 'What's Wrong with Risk Matrices?', showing that matrices can give identical ratings to risks that differ enormously, can rank a smaller risk above a larger one, and compress very different magnitudes into the same few bands. Those are not abstract complaints. They decide whether…
What you'll learn
- how a 5x5 risk matrix turns numbers into bands
- expected annual loss as a reference ranking
- rank reversals and ties, measured
- range compression in banded scores
- multiplying versus adding ordinal scores
- when a matrix is good enough and when to quantify
- reading Cox (2008) on risk matrices
Steps in this lab
- What the matrix does to your numbers
- Write the experiment
- Run it and read the damage
- Test the popular fix: add instead of multiply
- Use the matrix for what it is good at