Risk rating matrix

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What two things does a risk matrix plot against each other?

A Cost and speed

B Likelihood and impact

2. In a 3x3 risk matrix, a threat is rated High likelihood and High impact. Where does it sit?

A In the top-priority corner, rated High

B In the lowest-priority corner, rated Low

3. A 3x3 risk matrix has how many boxes (cells) in total?

A 6

B 9

4. A threat is Low likelihood and Low impact. What priority does the matrix usually give it?

A Low priority

B High priority

5. Risk A: High likelihood, Low impact (a spam email). Risk B: High likelihood, High impact (stolen admin password). Which do you fix first?

A Risk B

B Risk A

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1risk matrix		APhishing (High, High) -> Fix first Glitch (Low, Low) -> Fix later
2Likelihood: High, Impact: High		BLikelihood: Low, Impact: Low -> Low
3A threat that is unlikely and would cause only minor harm gets the lowest rating		CA high-impact risk should not be rated Low just because it is unlikely. In a 3x3 matrix it is usually Medium.
4Fix the highest-rated risk first: a likely phishing attack that could leak data beats a rare, minor glitch		DA risk matrix plots likelihood against impact. Using only one axis ignores half of the information.
5Likelihood: Low, Impact: High -> Low		EA grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating
6Rate risks using impact only, then pick the first one		FTop-right cell of a 3x3 matrix: a critical risk to fix first

Definitions

risk matrix

Fill in the Blanks

Complete each line of code by filling in the missing parts.

rating ← LOOKUP(matrix, __________, impact)

IF likelihood = 3 ___ impact = 3 THEN rating ← "high" END IF

A 3x3 matrix has 3 x 3 = _ cells

IF scoreA _ scoreB THEN PRINT "Fix A first" END IF

likelihood ← 2 impact ← 3 score ← likelihood _ impact

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A // scale is 1 to 3

B impact ← 5

C likelihood ← 2

D score ← impact * likelihood

Question 2

A score ← likelihood * impact

B if score <= 6 then

C rating ← "high"

D else rating ← "low"

Question 3

A if score >= 6 then

B rating ← "high"

C else if score > 6 then

D rating ← "medium"

E else rating ← "low"

Question 4

A phishing ← 9

B malware ← 4

C fixFirst ← min(phishing, malware)

D print(fixFirst)

Question 5

A matrix ← [[1, 2, 3],

B [2, 4, 5],

C [3, 6, 9]]

Answer Key

Risk rating matrix

Section A: Quick Questions

B — Likelihood and impact

A — In the top-priority corner, rated High

B — 9

A — Low priority

A — Risk B

Section B: Match the Pairs

risk matrix → A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating

Likelihood: High, Impact: High → Top-right cell of a 3x3 matrix: a critical risk to fix first

A threat that is unlikely and would cause only minor harm gets the lowest rating → Likelihood: Low, Impact: Low -> Low

Fix the highest-rated risk first: a likely phishing attack that could leak data beats a rare, minor glitch → Phishing (High, High) -> Fix first Glitch (Low, Low) -> Fix later

Likelihood: Low, Impact: High -> Low → A high-impact risk should not be rated Low just because it is unlikely. In a 3x3 matrix it is usually Medium.

Rate risks using impact only, then pick the first one → A risk matrix plots likelihood against impact. Using only one axis ignores half of the information.

Section C: Definitions

risk matrix — A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

Section D: Fill in the Blanks

rating ← LOOKUP(matrix, likelihood, impact)

IF likelihood = 3 AND impact = 3 THEN
    rating ← "high"
END IF

A 3x3 matrix has 3 x 3 = 9 cells

IF scoreA > scoreB THEN
    PRINT "Fix A first"
END IF

likelihood ← 2
impact ← 3
score ← likelihood * impact

Section E: Spot the Error

B — A 3x3 risk matrix only uses the values 1 to 3 for impact. A value of 5 is off the grid. It should be a number from 1 to 3, such as impact ← 3.

B — High ratings belong to high scores. Using <= would label low-scoring risks as high. It should be if score >= 6 then.

C — Scores of 6 or more were already rated high on line 1, so this test can never give medium. The medium band starts lower, so it should be else if score >= 3 then.

C — The risk with the highest score should be fixed first, so you need max(), not min(). It should be fixFirst ← max(phishing, malware).

B — Each cell in the matrix is likelihood * impact. For likelihood 2 the row is 2, 4, 6, so the 5 is wrong. It should be [2, 4, 6],.