← Years 9–10 Digital Systems

Risk rating matrix

A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 72, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 78, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 18, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 50, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 32

Understanding Risk rating matrix in Years 9–10 Digital Systems

What it does: Low likelihood and low impact sit in the bottom-left cell of the matrix, so the rating is Low and it can wait. Priority comes from the matrix rating, so the High-High phishing risk is fixed before the Low-Low glitch. 3 likelihood levels (low, medium, high) times 3 impact levels gives 9 cells. It is unlikely to happen and would not cause much harm, so it can wait while bigger risks are fixed first. Both are likely, but Risk B would do far more damage. A risk matrix helps you put the highest-rated risk first.

Common mistakes: A 3x3 risk matrix only uses the values 1 to 3 for impact. A value of 5 is off the grid. It should be a number from 1 to 3, such as impact ← 3. High ratings belong to high scores. Using <= would label low-scoring risks as high. It should be if score >= 6 then.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Risk rating matrix to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

What two things does a risk matrix plot against each other?

Cost and speedLikelihood and impact

Matches

Likelihood: Low, Impact: High -> Low

↓

A high-impact risk should not be rated Low just because it is unlikely. In a 3x3 matrix it is usually Medium.

Applying

Meanings

Term

risk matrix

Meaning

A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

Practice

Likelihood | Low impact | Med impact | High impact

Testing

Gaps

rating ← LOOKUP(matrix, , impact)

Check Answer

Spots

1// scale is 1 to 3

2impact ← 5

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What two things does a risk matrix plot against each other?

A. Cost and speed

B. Likelihood and impact ✓

A risk matrix is a grid with likelihood on one axis and impact on the other. Where they meet gives the priority rating.

2. In a 3x3 risk matrix, a threat is rated High likelihood and High impact. Where does it sit?

A. In the top-priority corner, rated High ✓

B. In the lowest-priority corner, rated Low

When both likelihood and impact are high, the risk gets the highest priority rating. It is likely to happen and would cause serious harm.

3. A 3x3 risk matrix has how many boxes (cells) in total?

A. 6

B. 9 ✓

3 likelihood levels (low, medium, high) times 3 impact levels gives 9 cells.

4. A threat is Low likelihood and Low impact. What priority does the matrix usually give it?

A. Low priority ✓

B. High priority

It is unlikely to happen and would not cause much harm, so it can wait while bigger risks are fixed first.

5. Risk A: High likelihood, Low impact (a spam email). Risk B: High likelihood, High impact (stolen admin password). Which do you fix first?

A. Risk B ✓

B. Risk A

Both are likely, but Risk B would do far more damage. A risk matrix helps you put the highest-rated risk first.

Match the Pairs

risk matrix → A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating

Likelihood: High, Impact: High → Top-right cell of a 3x3 matrix: a critical risk to fix first

A threat that is unlikely and would cause only minor harm gets the lowest rating → Likelihood: Low, Impact: Low -> Low

Fix the highest-rated risk first: a likely phishing attack that could leak data beats a rare, minor glitch → Phishing (High, High) -> Fix first Glitch (Low, Low) -> Fix later

Likelihood: Low, Impact: High -> Low → A high-impact risk should not be rated Low just because it is unlikely. In a 3x3 matrix it is usually Medium.

Rate risks using impact only, then pick the first one → A risk matrix plots likelihood against impact. Using only one axis ignores half of the information.

Key Term

risk matrix

A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

Fill in the Blanks

1. rating ← LOOKUP(matrix, likelihood, impact)

Hint: Type the variable for how probable the threat is, which picks the row in the matrix

2. IF likelihood = 3 AND impact = 3 THEN rating ← "high" END IF

Hint: Type the keyword that makes both conditions need to be true

3. A 3x3 matrix has 3 x 3 = 9 cells

Hint: Type the total number of cells in the grid

4. IF scoreA > scoreB THEN PRINT "Fix A first" END IF

Hint: Type the comparison operator that checks if A has the higher score

5. likelihood ← 2 impact ← 3 score ← likelihood * impact

Hint: Type the arithmetic operator that combines likelihood and impact into a score

Spot the Error

Question 1

A // scale is 1 to 3

B impact ← 5

C likelihood ← 2

D score ← impact * likelihood

Line B — A 3x3 risk matrix only uses the values 1 to 3 for impact. A value of 5 is off the grid. It should be a number from 1 to 3, such as impact ← 3.

Question 2

A score ← likelihood * impact

B if score <= 6 then

C rating ← "high"

D else rating ← "low"

Line B — High ratings belong to high scores. Using <= would label low-scoring risks as high. It should be if score >= 6 then.

Question 3

A if score >= 6 then

B rating ← "high"

C else if score > 6 then

D rating ← "medium"

E else rating ← "low"

Line C — Scores of 6 or more were already rated high on line 1, so this test can never give medium. The medium band starts lower, so it should be else if score >= 3 then.

Question 4

A phishing ← 9

B malware ← 4

C fixFirst ← min(phishing, malware)

D print(fixFirst)

Line C — The risk with the highest score should be fixed first, so you need max(), not min(). It should be fixFirst ← max(phishing, malware).

Question 5

A matrix ← [[1, 2, 3],

B [2, 4, 5],

C [3, 6, 9]]

Line B — Each cell in the matrix is likelihood * impact. For likelihood 2 the row is 2, 4, 6, so the 5 is wrong. It should be [2, 4, 6],.

Student with a class code? Join your class →