RAG Status Calculator: Score Probability and Impact on a 5x5 Matrix
A RAG status calculator multiplies probability by impact on a 1-5 scale and returns a score from 1 to 25. Scores of 1 to 6 are green, 8 to 12 amber, 15 to 25 red. The tool below returns the score, the band and the arithmetic behind it, and shows the full 5x5 matrix. Nothing is stored.
Choose a probability and an impact to see the score.
| Impact \ Probability | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | 5 Green | 10 Amber | 15 Red | 20 Red | 25 Red |
| 4 | 4 Green | 8 Amber | 12 Amber | 16 Red | 20 Red |
| 3 | 3 Green | 6 Green | 9 Amber | 12 Amber | 15 Red |
| 2 | 2 Green | 4 Green | 6 Green | 8 Amber | 10 Amber |
| 1 | 1 Green | 2 Green | 3 Green | 4 Green | 5 Green |
How the score is worked out
Probability multiplied by impact, both on a five-point scale, giving a number between 1 and 25. The bands are the common split: 1 to 6 green, 8 to 12 amber, 15 to 25 red. Several numbers in that range cannot occur — 7, 11, 13, 14 and anything above 20 other than 25 are not products of two numbers between 1 and 5 — which is why the matrix is worth reading as a grid rather than a scale.
The tool does not decide what probability 4 means in your organisation. That definition belongs in the risk management approach: whether a 4 is "more likely than not", "expected within the quarter" or something calibrated to a delivery window. The same applies to impact, which is usually anchored to money, schedule days, regulatory exposure or customer effect. Two people scoring the same risk differently is a definition problem, not an arithmetic one.
Where the band lands and where judgement starts
A band is a sorting device. It puts entries in an order so a governance meeting can start at the top rather than at the first row someone typed. It is not a decision. An amber risk with a mitigation owner and a date behaves very differently from an amber risk that has sat untouched for six weeks, and the score does not know the difference. That is why a RAID log carries an owner, a mitigation, a target date and a last-reviewed date alongside the score.
The date field
The optional date is the review or target date for the entry. The output reports how many days away it is, or how long it has been overdue. Nothing changes the score. Overdue mitigation dates on green entries are frequently more interesting than the red ones, because red entries are the ones already being watched.
Scoring one entry versus running a register
This tool scores a single line. A register does the same arithmetic across a hundred lines and then has to answer harder questions: what is open, what is overdue, what has not been reviewed since the last board, and what got closed without evidence. Those are the questions the RAID log guide works through, and the difference between a RAID log and a risk-only register is covered in RAID log vs risk register. If the output has to be presented rather than filtered, a risk register in PowerPoint keeps the heatmap and the register on the same page.
Privacy
Everything runs in the browser. No entry text is requested, nothing is sent anywhere, and nothing is saved — reloading the page clears it.
Questions
What score makes a risk red?
In the split used here, 15 and above is red, which means at least one of probability or impact is a 5, or both are 4 or more. Organisations set their own thresholds, so check the risk management approach before quoting a band.
Why are some scores between 1 and 25 missing?
Only products of two numbers between 1 and 5 can occur, so 7, 11, 13, 14, 17 to 19 and 21 to 24 never appear. The full set of possible scores is visible in the matrix.
Does the calculator store what I enter?
No. It runs entirely in the browser, asks for no personal details and saves nothing. Reloading the page resets it.
Can I use this for issues as well as risks?
The arithmetic is the same, but an issue has already happened, so probability is effectively 5 and the useful number is impact. Most RAID logs score issues on impact and urgency instead.
Should the score drive escalation?
The score orders the register. Escalation thresholds, who they go to and how fast are set in the governance approach, and the log records who was told and when.