3.3: Milestone 2 – Defining Impact- Risk Impact Matrix

Milestone 2 – Prioritizing Risk: Impact Matrix and Risk Themes

Tool Applied: Risk Impact Matrix

Final Output: Visual Risk Matrix + Risk Themes Summary Memo

Welcome Back, Risk Strategist

Your RBS (from Milestone 1) laid the groundwork. Now, it’s time to turn insight into action.

This milestone challenges you to answer the hardest question in risk management:

“Out of everything that could go wrong… what should we actually focus on right now?”

In real projects, you never have unlimited time or resources. So you’ll need to prioritize the most pressing, damaging, and high-stakes risks using a tool professionals swear by—the Risk Impact Matrix.

You’ll also write a short summary memo that highlights the top 3–5 themes SMDC leadership should focus on right away. Your insights will influence sprint planning, investor briefings, and which controls get built next.

Scenario Briefing

INTERNAL MEMO
To: Risk Management Team – Embedded Analysts
From: Kira L. Joshi, COO, SMDC
Date: Week 3 – Risk Prioritization Phase
Subject: Request for Prioritized Risk Profile Using Impact Matrix

Team,

Thank you for delivering the Risk Breakdown Structure (RBS) last week. It gave us our first clear picture of where uncertainty and vulnerability live across our SMDC dashboard initiative. Engineering, UX, and Clinical have already used it to start sprint planning and discuss alert design constraints.

But we now need to go deeper.

The RBS shows us where risk exists. What we need next is a decision-making lens for understanding which risks matter most—now. We’re on a tight build timeline and don’t have the resources to address every single risk at once.

Please use a Risk Impact Matrix to analyze, compare, and prioritize the items from your RBS. Your job is to help the team:

• Understand which risks are likely to materialize
• Estimate how damaging they would be across core project pillars
• Identify 3–5 priority themes to guide deeper planning and mitigation

You’ll need to assess likelihood, impact, and exposure across several domains—technical performance, regulatory status, user safety, financial exposure, reputational damage, and social equity.

We will use your output to:

• Sequence our design sprints
• Inform investor risk disclosures
• Begin selecting control strategies

You’re not just flagging risks anymore. You’re helping us decide what to do about them.

—Kira

Action Strategy

Purpose of This Milestone
This milestone transitions your work from categorization to prioritization. In Milestone 1, you identified what could go wrong. In Milestone 2, you’ll determine which risks should command the team’s attention first.

You’ll do this using two powerful tools:

• A Risk Impact Matrix to compare risk severity

• A Risk Theme Memo to communicate which risk clusters are most urgent, sensitive, or high-cost

Step-by-Step Guide

Step 1: Review Your RBS (Milestone 1)

• Open your Risk Breakdown Structure (Milestone 1)
• Highlight or extract 15–20 Level 3 risk items for initial scoring
• Choose a representative spread—covering different domains, types, and assumptions

If working as a team:

• Divide the risks by theme (e.g., clinical, UX, infrastructure, regulatory)
• Have each person lead the scoring conversation for their cluster

Step 2: Define Impact Dimensions

You will assess each risk along two axes: Likelihood and Impact, scoring across six lenses:

1. Technical Impact – Product failure, system crash, data corruption
2. Clinical Impact – Patient confusion, alert misinterpretation, potential harm
3. Regulatory Impact – HIPAA violations, FDA penalties, compliance delays
4. Financial Impact – Cost overruns, lost funding, rework costs
5. Reputational Impact – Loss of trust from patients, investors, partners
6. Equity Impact – Marginalized users excluded, language/UX barriers

Assign:

• Likelihood Score (1–5) – Probability of occurrence
• Impact Score (1–5) – Severity across each dimension

Rubric:
1 = Low: Unlikely and limited impact
2 = Mild: Manageable but visible
3 = Moderate: Interruptive and reputationally concerning
4 = High: Requires redesign, funding risk, legal flags
5 = Severe: Systemic failure, patient harm, or project derailment

Step 3: Build the Matrix

• Rows: Each risk
• Columns: Risk name, Likelihood, six impact dimensions, Total Weighted Score, Notes
• Highlight highest total exposure
• Flag outliers with high single-domain scores

Step 4: Visualize Risk Zones (Optional)

Use a 2x2 or 3x3 matrix to map risks into quadrants:

	High Impact	Low Impact
High Likelihood	Top priority risks	Process risks
Low Likelihood	Rare but severe risks	Low-priority risks

Color-code:

• Red = High priority
• Yellow = Monitor
• Gray = Acceptable or defer

Step 5: Synthesize Risk Themes

• Identify patterns or clusters
• Determine cross-domain risks
• Write a short memo naming 3–5 high-priority risk themes with reasoning and suggested responses

Your Deliverable

Part 1: Risk Impact Matrix

• Include 15–20 risk items from RBS
• Score likelihood and six dimensions
• Highlight high exposure risks

Part 2: Visual Quadrant (Optional)

• 2x2 or 3x3 visual with color codes

Part 3: Risk Themes Summary Memo

• 3–5 emergent risk themes with explanations and next steps

Toolkits and Templates

• Risk Matrix Template
• Sample Impact Scoring Rubric
• Visual Quadrant Template
• Milestone 1 RBS File
• Sample Risk Theme Memo
• Appendix: Impact Weighting Guide

Critical Reflection (Required)

Write 150–250 words addressing:

• Most challenging dimension to score
• Shifts after pattern analysis
• Most useful insights for leadership
• Lessons learned in risk triage and prioritization

Quality Control Review

• At least 15 risks scored across all categories
• Clean, consistent formatting
• Memo includes 3–5 risk themes
• Reflection addresses process and insight

Final Wrap-Up and Submission

Your submission will be reviewed and reused in Milestones 4, 9, and 10.
This is where your risk analysis starts shaping real decisions.