ISO Mate scores every risk on a 5×5 matrix: likelihood and impact are each rated from 1 to 5, and their product is a score from 1 to 25. Fixed bands turn that score into a level of low, medium, high, or critical. The heatmap plots your active risks on the same grid so you can see where exposure concentrates.
How the score works
Each risk is measured on two axes, likelihood and impact, each rated from 1 to 5. The score is likelihood multiplied by impact, giving a value from 1 to 25. This single calculation is used everywhere risks are scored, so inherent, residual, and target exposure are all directly comparable.
Level bands
Scores map to four level bands:
- Low: 1 to 4.
- Medium: 5 to 10.
- High: 11 to 15.
- Critical: 16 to 25.
The level, not just the raw number, drives how a risk compares to your appetite. See Setting Your Risk Appetite for how over appetite is determined.
Inherent, residual, and target
Inherent exposure is the risk before treatment. Residual exposure is the risk after your controls are considered, and it reflects your real position today. Target exposure is the level you are aiming for once treatment is complete. The register and heatmap focus on residual exposure by default because it shows where you stand right now.
Reading the heatmap
The heatmap arranges active risks on a 5 by 5 grid by likelihood and impact. Each cell is coloured by its level band, and the number in a cell shows how many risks fall there. Select a cell to drill into the risks it contains. A layer toggle switches the plotted exposure between inherent, residual, and target, so you can compare where risks start, where they sit today, and where you intend them to land. The totals also count how many active risks are over appetite.
Related articles
See your risk posture at a glance. Start your free 14-day trial.