Define the scales before scoring
A 1–5 likelihood and impact scale is only useful when the organization defines what each level means. Write the definitions into your process rather than relying on color alone.
Separate inherent and residual risk
Inherent risk describes exposure before controls; residual risk reflects the expected exposure after controls. Mixing them hides whether mitigations actually change the profile.
Assign an owner and action
A risk register without accountability becomes documentation rather than management. Record an owner, mitigation and review date for material items.
Do not treat the score as a universal standard
Risk matrices are prioritization aids. Regulatory, safety, security and engineering decisions may require domain-specific methods beyond a 5×5 score.