Impact × likelihood in practice

From a worried list to a plan

It is easy to end up with a long list of things that could go wrong and no idea where to start. Everything feels a little urgent, so nothing gets fixed. The point of measuring risk is to break that stall: to turn a vague pile of worries into an ordered plan.

The tool for that is the small formula introduced in Threats, vulnerabilities and risk:

Priority = Impact × Likelihood

As a reminder, impact is how bad it would be if the thing happened and likelihood is how probable it is. Multiplying them puts very different problems onto one comparable scale. This lesson is about actually using that score to decide what to fix first.

Score it simply

You do not need precise numbers. A rough scale of 1 to 5 for each is plenty:

• Impact 1 is a minor annoyance; impact 5 would be a serious loss (money, data, safety, reputation).
• Likelihood 1 is very unlikely; likelihood 5 is almost expected.

Multiply the two and you get a priority score between 1 and 25. The exact figure is not the goal. The ranking it produces is.

A worked example

Take a short, everyday list, the kind of thing anyone might jot down about their own digital life:

Concern	Impact	Likelihood	Priority
Main email has no multi-factor authentication (MFA) and a reused password	5	4	20
No backup of family photos on the laptop	5	3	15
Phone software several updates behind	3	4	12
Weak PIN on a rarely used loyalty app	1	3	3

Now the list sorts itself. The unprotected main email scores highest, because losing it is severe and, with a reused password and no MFA, it is very much exposed. That is where you start. The missing backup is next: just as painful if it happens, but a little less likely on any given day. The outdated phone follows, and the weak PIN on a throwaway app sits at the bottom, worth doing eventually but not first.

Using the ranking

The value of the formula is that it settles arguments with yourself. Instead of fixing whatever you noticed last, or whatever feels scariest in the moment, you work down from the highest score.

Two habits make it work in practice:

• Deal with the top item before the rest. A high score means high impact and high likelihood together, which is exactly what you want to remove first.
• Do not chase the bottom of the list while the top is unaddressed. A rare, low-impact problem can wait; a likely, costly one cannot.

The same method scales from a personal list to a whole organisation's. The numbers get more detailed, but the move is identical: score by impact times likelihood, then fix from the top down.

Try it yourself

Place each scenario on the grid and watch its priority appear as Impact × Likelihood; the highest scores rise to the top, exactly as they should on your real list.