How to use the matrices

Starting from a decision and a scope

A matrix is used to organize a documented discussion on risks. It does not predict a crisis and does not transform a collective assessment into scientific measurement. To use it, define the activity, the site or product concerned, the audiences exposed, the time horizon and the decisions to prepare. In this collection, the horizon proposed for the exercises is twelve months; this is a convention to be adapted, and not a regulatory duration.

The ISO 31000 family provides a general risk management framework. The matrices and thresholds in this collection are original editorial proposals: they do not reproduce a grid prescribed by ISO. Sectoral sources shed light on the issues cited; they do not validate the probabilities or hypothetical scenarios presented here.

Separate the scenario, its causes and its consequences

Describe a specific event, the conditions that could produce it and its possible consequences. A general formula like reputation risk is not enough. Actionable wording indicates, for example, that safety information might not reach affected users because distributor contact details are incomplete. This formulation makes it possible to identify an action and proof of achievement.

Consider the effects on people, operations, the environment, applicable obligations and trust. In the examples, severity reflects the most severe dimension among those which are plausible; it does not take the average between human damage and a commercial cost. This convention must be discussed with business managers and relevant specialists.

Define scales before grading

For probability, the illustrative grid goes from 1, exceptional but credible, to 5, very frequent or recurring. The intermediate levels are 2, unlikely, 3, plausible, and 4, probable. These terms only make sense with a common horizon and elements of justification. They do not correspond to universal percentages. Absent data should not be silently replaced by a low score.

For severity, 1 designates a minor and easily reversible effect; 2 a limited effect requiring correction; 3 a significant effect disrupting the activity or experience of the public; 4 a major effect with lasting consequences; 5 a critical effect, particularly when serious human harm or essential interruption is plausible. The precise operational thresholds remain to be defined for each organization.

Use the score to inform, not replace, a decision

The illustrative score is P × G, from 1 to 25: 1–4 low, 5–9 moderate, 10–15 high and 16–25 critical. These bands are editorial conventions, not regulatory thresholds. Any scenario with impact 5 receives priority attention regardless of its score: low likelihood does not cancel a potentially critical consequence.

The product of ordinal scores is not an expected loss or a calculated probability. Two scenarios with the same score may require very different decisions. Add to the discussion speed of evolution, detectability, dependencies, uncertainty and responsiveness. When an event is initiated, the facts and operational thresholds must guide escalation; you should not wait to recalculate a probability.

Linking initial risk, treatment and residual risk

First assess the risk before the measures considered, then describe the protections already in place and additional actions. Risk treatment may aim to avoid the activity, reduce the likelihood or consequences, share certain contractual consequences or accept residual risk under a defined authority. A financial transfer does not remove the responsibility to protect people or that of informing.

The residual risk must be reassessed based on measures actually implemented and verified. An announced action does not justify an automatic reduction of the rating. The matrices in this collection therefore do not offer a fictitious residual score. For each scenario, name a person responsible, a deadline, expected evidence and a review date; these elements must be defined in the user organization.

Prepare crisis triggers and communication

The matrix should specify the signals that trigger a verification, an alert to management or the activation of the crisis management team. Provide a substitute and a usable channel when the usual tools are unavailable. Safety decisions, notification obligations and medical or technical instructions are the responsibility of the competent managers: an editorial grid cannot determine them for them.

For each public statement, distinguish established facts, hypotheses, unknowns, decided measures and time of the next update. Messages must be consistent across internal teams, partners and public channels. The translation must preserve the reservations and the degree of certainty; a European or American source remains situated in its context and does not become a local rule simply by changing the language.

Test, observe and review

A useful exercise introduces contradictory information, unavailability of a manager and difficulty in understanding. It measures the ability to decide with partial information, correct a version and reach the relevant audiences. The speed of writing a press release is only one part of the test.

After the exercise, document discrepancies, verify corrections and review ratings. Keep versions to understand why a score or threshold has changed. The matrix must be re-examined when the activity, partners, risks or knowledge evolve. Its value lies in this regular use, not in the color of the boxes.

Cite this article

Belief System. How to use the matrices. 2026-10-09. https://beliefsystem.fr/en-in/regards/crisis-risk-matrix-method/