If you've ever managed risk, you've used a probability × impact matrix. It's the bedrock of almost every risk framework — ISO 31000, PRINCE2, PMBoK, they all use it. Probability on one axis. Impact on the other. Multiply. Log the score.
Simple enough. But the simplicity hides a problem. Most teams score by intuition, rarely revisit scores, and use the matrix as a documentation exercise rather than a decision tool. The result is a risk register full of numbers that mean nothing consistent.
What P×I Actually Measures
Probability × Impact gives you a risk score — a single number that combines how likely a risk is to occur (probability) with how bad it will be if it does (impact). On a standard 1–5 scale, the highest possible score is 25. The lowest is 1.
A P5 × I5 risk — maximum probability, maximum impact — is a near-certain catastrophe. A P1 × I1 risk is an unlikely, minor inconvenience. Everything in between needs a decision: monitor, mitigate, escalate, or accept.
The matrix tells you where to direct attention. A P4 × I4 (score 16) probably needs the PMO involved. A P2 × I2 (score 4) probably doesn't. The threshold is the rule that determines which is which.
The 5×5 Grid in Practice
Most organisations use a 5-point scale for both axes. Here's what each point typically means — though you should define these for your context:
- Probability 1
- Rare — unlikely to occur in normal circumstances
- Probability 2
- Unlikely — could occur but has not happened recently
- Probability 3
- Possible — has occurred before or current conditions make it plausible
- Probability 4
- Likely — expected to occur; similar events are common
- Probability 5
- Near-certain — will almost certainly occur without intervention
Impact follows the same logic, but measures consequence rather than likelihood. A 5 on impact might mean project failure, regulatory sanction, or significant financial loss — depending on your organisation's thresholds.
The critical point: these definitions need to be agreed before scoring starts, not after. If your team in London scores probability differently from your team in Edinburgh, your portfolio risk view is meaningless.
The Three Places Teams Go Wrong
P×I looks simple, but there are consistent patterns where risk scoring breaks down.
1. Scoring by gut feel, not definition
Most risk owners score without consulting the scale definitions. A P4 to one person is a P3 to another. The same risk gets scored differently across projects. When your PMO tries to view risks at portfolio level, you're comparing apples to oranges.
The fix: pin your probability and impact definitions somewhere visible. Make them part of the risk logging interface, not a PDF buried in SharePoint. Every time someone scores a risk, the definitions are in front of them.
KinetiRisk applies the same scoring model to every risk, automatically. No gut feel. Start free →
Start free See pricing2. Conflating score with priority
A risk score of 16 (P4 × I4) and a risk score of 16 (P2 × I8) are mathematically identical. But they need different responses. A high-probability, moderate-impact risk might need immediate mitigation. A low-probability, catastrophic-impact risk might need contingency planning and board awareness.
The score is a starting point for the conversation, not the end of it. Teams that treat a score of 16 as identical to every other score of 16 miss this nuance. The breakdown of P and I matters as much as the product.
3. Setting it and forgetting it
Risk is not static. A supplier risk scored at P2 × I4 in January might be P4 × I4 by March if the supplier is struggling. A delivery risk might drop from P4 to P2 after a milestone is hit.
Most teams score once during project initiation and never revisit. The risk register becomes a historical document rather than a live management tool — for a detailed breakdown of why this happens, see our guide on risk register software. Regular review cycles — monthly for active risks, quarterly for long-tail risks — are the minimum.
Setting Escalation Thresholds
Once you have consistent scoring, the next question is: at what score does a risk escalate? This is the threshold — the line above which a risk moves from the project manager's queue to the PMO or programme manager's queue.
A common starting point is P×I ≥ 15 as the escalation trigger. That means a risk must score 15 or above before it's automatically routed upward. Below 15, the project manager owns it. At 15 or above, the programme manager is looped in.
In KinetiRisk, the escalation threshold is fixed at P×I ≥ 15 across all projects — providing a consistent standard without per-project configuration. For teams maintaining a RAID log alongside their risk scores, see our guide on RAID log management.
How AI Improves P×I Scoring
The biggest P×I problem — inconsistency — is exactly what AI solves. When you describe a risk to an AI system, it proposes a probability and impact score based on the risk description, the industry context, and patterns from similar risks. The proposal is consistent: the same risk described the same way gets the same score every time.
What AI doesn't do is decide for you. The proposed score is a starting point. You review it, adjust it if your context warrants a different view, and approve it. Your name is on the decision. The audit trail records your judgment, not the AI's.
The result is a risk register where scores are calibrated, consistent, and defensible — but consistent scoring is only half the picture. For a look at how those scores fit into a governance structure with clear accountability and audit trails, see our guide to AI risk scoring and governance.
KinetiRisk uses structured AI reasoning — the same description will produce the same score every time, removing the variation that comes from different people scoring on different days.
Once you have a consistent score, the next question is: what does that score look like after your mitigations are in place? See our guide to residual risk and how to calculate it.
Frequently Asked Questions
What is a probability impact matrix in project risk management?
A probability impact matrix (or P×I matrix) is a tool that scores each risk on two dimensions: how likely it is to occur (probability, rated 1–5) and how severe the consequences would be if it did (impact, rated 1–5). Multiplying the two gives you a risk score from 1 to 25, which you use to prioritise which risks need immediate attention and which can be monitored.
What P×I score should trigger escalation?
A common starting point is P×I ≥ 15. A score of 15 or above means the risk is either high probability, high impact, or both — and needs a decision-maker's attention, not just monitoring. In KinetiRisk, escalation is automatic when a score reaches this threshold, moving the risk into a reviewer queue immediately.
Why do risk scores become inconsistent across teams?
Inconsistency happens because probability and impact definitions are rarely visible at the point of scoring. One person's 'likely' is another person's 'possible'. Without a shared calibration point, five project managers scoring the same risk will produce five different numbers. AI scoring solves this by applying the same logic to the same description every time — removing drift without removing the reviewer's ability to override.
How does AI improve P×I scoring without removing human judgment?
AI proposes a probability score, an impact score, and a plain-English rationale for each risk you describe. You review the proposal, adjust it if your context warrants it, and approve. The AI creates a consistent baseline; the human makes the final call. Your name is on the decision, not the AI's.
Key Takeaways
- P×I scoring multiplies probability (1–5) by impact (1–5) to produce a risk score from 1–25
- Define your scale before scoring starts — inconsistent definitions undermine your entire risk portfolio view
- A score of 16 means different things depending on the P/I breakdown — treat the components, not just the product
- Set a clear escalation threshold and enforce it automatically — a common starting point is P×I ≥ 15 (automatic email alerts available on Starter, £5/month, and above)
- Review risk scores regularly — scores set at project initiation become stale quickly
- AI scoring removes gut-feel variation and creates a consistent, comparable baseline across your portfolio
Ready to stop guessing at risk scores? KinetiRisk makes consistent P×I scoring the default.