Risk matrices and the residual / target / appetite triple

A risk matrix encodes a qualitative judgement about a single risk as a coordinate in a two-dimensional grid. The vertical axis is likelihood (how often the risk event would occur); the horizontal axis is consequence (how severe it would be if it did). Each cell carries a rating band — Low, Moderate, High, or Extreme — and a colour. The cell tells the reader where the risk sits at a glance, before they engage with the underlying detail.

Beau-Tie's default is a 5×5 grid (likelihood L1 Rare → L5 Almost Certain, consequence C1 Insignificant → C5 Catastrophic), which is the most common encoding worldwide and the one ISO 31000 practitioners default to. The matrix is fully configurable in-tool — relabel axes, recolour cells, change the size — but the same principles apply at any dimension.

What the matrix actually does

A matrix is a compression function. It takes the full set of likelihood and consequence judgements you could make about a risk and projects them onto a small, ordered set of bands. That compression has two purposes:

1. Comparability across risks. Once every risk in a register sits in a cell, you can rank them. "Which risks are Extreme?" is a question with a clean answer; "which risk has the highest likelihood × consequence product?" is a question whose answer depends on how you score things.
2. Triggers for action. Most organisations attach governance to bands: Extreme requires CEO sign-off; High requires a documented treatment plan; Moderate requires ownership; Low gets monitored. The bands are the policy hook.

Reading a 5×5 matrix

The default colour bands in Beau-Tie are:

• Low (muted green) — within tolerance, treat as BAU. Score range: 1–5 (lower-left quadrant).
• Moderate (soft ochre) — manage actively, monitor for drift. Score range: 6–11.
• High (warm-ink-red) — meaningful concern, treat before it materialises. Score range: 12–19.
• Extreme (ink-red) — alarm signal; either treat urgently or escalate for explicit acceptance. Score range: 20+.

The colours are deliberately desaturated relative to the typical traffic-light heatmap. The May 2026 design system principle is that risk matrices should read calm enough to live in a meeting deck without pulling attention from the surrounding context — the reader's eye lands on the plotted ratings (the dots), not on the background heat.

The three plotted ratings

A single rating point on a matrix tells one story: where this risk sits today. That's useful but thin. The Beau-Tie convention plots three points per risk — residual, target, and (optionally) appetite — because the gap between them carries the actual decision content.

Residual (R) — where you are

The risk rating after existing controls have been accounted for. Inherent risk (rating before any controls) is sometimes elicited as a thought experiment, but Beau-Tie doesn't plot it because it isn't actionable — controls already exist; the residual is the truth on the ground.

Plotted as a teal dot in the matrix.

Target (T) — where you're going

The residual you'd reach once the planned controls (the dashed circles in the bow-tie diagram) come online. The gap between R and T tells you whether your treatment plan is ambitious or modest. A target equal to the residual is a flag — you've planned no treatment, which is fine if the residual is already at or below appetite, but should be conscious if it isn't.

Plotted as a confidence-green dot.

Appetite (A) — what you'll tolerate

The threshold above which the organisation will not accept the risk to remain. Appetite is policy, not a risk-specific judgement — it usually comes from board-level statements about tolerance for different risk categories. ISO Guide 73:2009 defines it as "the amount and type of risk that an organization is willing to pursue or retain".

Plotted as a muted-grey dot. Optional in Beau-Tie because not every organisation maintains explicit appetite statements; toggleable per bow tie.

The three positions and what they mean

The three plotted points yield a small library of recognisable patterns:

• R above A, T above A. You're outside appetite today and your treatment plan still leaves you outside. The treatment isn't ambitious enough — escalate.
• R above A, T below A. Outside appetite today, plan brings you within. Pressure-test the timeline on the planned controls; the risk lives at residual until they land.
• R within A, T below R. Already within appetite; treatment is improving the position further. Defensible but ask whether the treatment effort is best spent here vs. on a risk that's outside appetite.
• R within A, T = R. Within appetite, no treatment planned. Healthy posture as long as the rating is honest.

The well-known critiques

Risk matrices have a substantial academic literature pointing out their limitations. Worth knowing, even if you continue to use them (which most organisations do, and Beau-Tie supports):

• Cox's critique (2008). Tony Cox showed that standard 5×5 matrices can produce risk-ranking inversions — two risks where matrix A says "treat this one first" and a coherent quantitative scoring says the opposite. The fix is either to use the matrix purely for comparability within a program (avoid cross-program comparisons) or to back the matrix with a quantitative model where the stakes warrant it.
• Anchor sensitivity. Workshop ratings shift measurably when participants discuss them in different orders or with different priming. Mitigate with calibration training and double-blind elicitation when the stakes warrant it.
• Range compression. A 5×5 matrix has 25 cells but most risks cluster in a few of them. The discriminating power between two risks both rated "L3 × C3 = Moderate" is zero. Beau-Tie's residual / target / appetite triple recovers some of this — the gap between R and T discriminates even when the residual cells are the same.

The pragmatic position: matrices are useful as the qualitative layer of a risk program, especially for triage and policy hooks. Where a single risk is large enough to drive material financial decisions, complement the matrix with a quantitative model — i.e. run that risk through PRQ, or pull it into a more detailed bottom-up analysis.