What is a risk heatmap?
A risk heatmap is a grid that shows many risks at once. Likelihood runs along one side. Impact runs along the other. A risk with likelihood 4 and impact 5 goes in the cell where those two meet. Colors show how serious each zone is.
The map is a picture of your risk register. If the register is out of date, the map is wrong too. Our guide to building a risk register explains how to keep the underlying list sound.
How do you read the grid?
Read it in three zones.
| Zone | Position | What it means | Usual response |
|---|---|---|---|
| High | Top right | Likely and serious | Leadership acts now, with a dated plan |
| Medium | Middle | Possible and noticeable | Owner manages; review each quarter |
| Low | Bottom left | Unlikely and minor | Watch; accept or review yearly |
Two corners deserve extra thought. Top left (likely but minor) risks are annoying and add up, so look for a cheap fix. Bottom right (rare but severe) risks are easy to ignore because they seem unlikely. A fire at the only office, or a donor withdrawing without notice, may be rare, yet the result would be so large that you still need a plan.
How to use the map in a meeting
- Print or show the map once. Do not hand out ten pages. One picture keeps the group focused.
- Start at the top right. Take each risk there in turn. Ask: is the score still right, is the owner acting, is the action on time?
- Check movement. Compare with the last map. Which risks moved up, down or off the map? Ask why for each move.
- Pick a short list. Choose the few risks that need a leadership decision or resources. Write them down with an owner and a date.
- Close the loop. At the next meeting, start with the actions from this one.
What mistakes should you avoid?
- Scoring by mood. After a bad week every risk looks red. Use the written scale, not the feeling.
- Too many dots. More than about 30 risks on one map is unreadable. Show organization-level risks on the main map and keep project-level risks on separate maps.
- Treating the map as the plan. A red dot is only a flag. The action plan lives in the register.
- Hiding the bad news. If every risk is green, ask whether anyone is scoring honestly. A map with no red can mean people feel unsafe reporting.
- Mixing current and target scores. Decide whether the map shows risk today or risk after planned actions. Label it clearly, and use one view per map.
How does the map help the board?
A board does not need every line of the register. It needs to know what could hurt the organization most and what management is doing. The heatmap gives that in one page. Pair it with a short note on the top five risks: what changed, what has been done, and what you need from the board.
Over a year, a series of maps also shows whether your risk work has an effect. If the same risk sits in the top right for four quarters, either the action is not working or the owner lacks the resources. That is a useful conversation.
A short example
A leadership team looks at its heatmap. Three risks sit in the top right: the loss of the largest grant, a security incident at a field site and the departure of the finance lead. For each, the team asks the same three questions: is the score still right, who owns the action and is it on time?
The finance lead risk has moved down since last quarter, because a deputy has been trained and has signed authority at the bank. The team records that action as the reason for the lower score. The grant risk has not moved, and the action was late. The director agrees to bring a renewal plan to the next meeting.
In twenty minutes the team has used the map to make two decisions and one note of progress. That is what a heatmap is for: it focuses attention, and the register holds the detail.
Where EMPOBase fits
EMPOBase includes a Risk Heatmap next to the Risk Register in Governance & Compliance, so a change to a risk’s score shows up on the map without redrawing a slide. You can see the broader platform or contact us for a demonstration. The heatmap shows the scores your team enters. It does not judge whether those scores are right, so your scoring scale and your review habit still decide how useful it is.