Probability & Impact Matrix

Probability & Impact Matrix

Introduction: Why This Matters

Every project faces uncertainty. Not all risks are equal. Some occur often but have low impact, while others are rare but catastrophic. The Probability and Impact Matrix provides a structured way to prioritize risks by assessing both their likelihood and their potential effect.

On the PMP exam, this tool is tested because it demonstrates the core principle of risk management: not all risks deserve equal attention. In practice, it ensures that project managers and stakeholders focus on the risks that could truly alter project outcomes.

Purpose and Objectives

Primary Purpose: Rank risks by combining their likelihood of occurring with the magnitude of their impact.

Key Objectives:

  • Define the Probability and Impact Matrix and explain its use.
  • Apply probability and impact scales to assess risks.
  • Differentiate between high-priority and low-priority risks.
  • Use the matrix to determine which risks require response planning.
  • Recognize how this tool is tested on the PMP exam.

Overview

The Probability and Impact Matrix is a simple grid that helps teams rank risks consistently and decide which ones deserve time, money, and response planning.

  • Probability: The likelihood that the risk will occur (often a scale or percentage).
  • Impact: The severity of the risk if it occurs (cost, schedule, scope, quality, or multiple dimensions).
  • Priority ranking: A combined view that sorts risks into high, medium, or low categories.

Characteristics

  • Two-dimensional: Uses probability on one axis and impact on the other.
  • Prioritization tool: Designed to prevent treating all risks the same.
  • Threshold-driven: Aligns with organizational risk appetite and risk thresholds.
  • Decision support: Helps select which risks require response planning and deeper analysis.

Practical Example

Context: A university technology upgrade project has multiple risks, and the team must decide which risks require formal response planning.

Activities:

  • Plot risks: Place each risk on the matrix using the agreed probability and impact scales.
  • Interpret priority: Identify which risks land in high-priority zones (even if probability is low).
  • Select responses: Choose high-priority risks for response planning and monitor the rest.

Outcome: Response planning focuses on the cybersecurity breach and grant funding cut because their impacts are severe. Delivery delays are managed proactively, while team turnover is monitored due to lower impact.

Common Pitfalls

Prioritization Mistakes

  • Pitfall: Focusing only on probability and ignoring low-probability, high-impact risks.
  • Prevention: Always evaluate probability and impact together. High-impact risks can outrank frequent low-impact risks.
  • Pitfall: Overcomplicating scales and making the matrix unusable.
  • Prevention: Keep scales simple and aligned to organizational standards.
  • Pitfall: Treating all risks as equal, defeating the purpose of the matrix.
  • Prevention: Use clear ranking bands and stick to them consistently.
  • Pitfall: Forgetting thresholds and over-responding to mid-level risks.
  • Prevention: Use risk thresholds to decide which risks truly require formal response planning.

Sensei Tip : When two risks compete, let impact break the tie. A “rare but deadly” risk often deserves the first response plan.

Exam Alert : The exam loves the trap “highest probability wins.” It does not. Priority comes from the combined probability and impact ranking.

Exam Lens

Patterns on the PMP Exam:

  • Expect questions that ask which risks to prioritize given probability and impact data.
  • Look for recognition that a low-probability, high-impact risk can still be critical.
  • Watch for traps where all risks look similar. The key is ranking, not guessing.

Sample Question

Question: Which risk should be prioritized for response planning?

  1. Probability = 0.7, Impact = Low
  2. Probability = 0.3, Impact = High
  3. Probability = 0.5, Impact = Medium
  4. Probability = 0.8, Impact = Very Low

Correct Answer: B. Even with lower probability, the impact makes it a higher priority than risks with low or medium impacts.

Quick Recap Table

Risk Example Probability Impact Priority
Vendor delay Medium Medium Moderate
Cyber breach Low High High
Team turnover Medium Low Low
Funding cut Very Low Very High High

Key Takeaways

  • The Probability and Impact Matrix ranks risks by likelihood and severity.
  • Both probability and impact must be considered together.
  • High-impact risks often outweigh frequent low-impact risks.
  • Risk thresholds determine which risks require active response planning.
  • On the PMP exam, look for context clues that emphasize impact as much as probability.

Next Step

With the Probability and Impact Matrix complete, we move into Expected Monetary Value (EMV), which applies probability and impact in a quantitative way to estimate the financial exposure of risks.

Bibliography

Project Management Institute. (2021). A Guide to the Project Management Body of Knowledge (7th ed.). Project Management Institute.

Scroll to Top