Risk management presentation: the 10-slide template, the 5×5 risk matrix and the register slide, with a worked example

Disclosure: NOXI publishes this guide and is one of the tools it mentions; the method works in any presentation software.

Most risk decks are a red-amber-green grid and a 40-row register pasted onto a slide. The committee sees colour, not choices. A useful one scores every risk with one written rule, shows what controls change, and ends with owned, dated decisions. Below: the 10-slide template, the 5×5 scoring rule, the before-and-after and money slides, three versions, and a fictional food plant, Kestrel Foods, worked through in full.

Key numbers

The first four are the official anchors for the method below; the last two are 2026 context for a January risk review.

What is a risk management presentation?

A risk management presentation is a short slide talk that tells a decision-making group which risks matter most, how they were scored, what the controls change and what decisions are needed now. It is the meeting version of a risk register: five risks and their decisions on screen, the full list in the file.

Four groups give this talk: project managers with a steering group, risk and audit teams with a board, safety coordinators with a site, and students on MBA, engineering and PMP courses. The spine is the same; the scales change.

Risk management presentation vs risk assessment presentation

A risk assessment presentation reports one assessment: the risks found, who they affect, their scores and the controls needed. A risk management presentation reports the cycle over time: controls in place, what changed since the last review and the decisions due.

The 10-slide risk management presentation template

The 10-slide risk management presentation template runs 10 minutes: context and appetite, method and scales, the matrix, the top five risks, the register, inherent vs residual, the expected loss of the top risk, actions and owners, what changed since the last review, and decisions needed. The matrix and the top five get the most time.

These timings are our planning guidance, not a standard, for a 15-minute slot with 5 minutes of questions.

Risk management presentation PPT and PDF

To build a risk management presentation PPT, make ten slides, rewrite each slide name above as a finding ("Ransomware is still high after controls"), and give each slide one table or chart. Send the PDF as a pre-read two working days before the meeting.

How many slides for a risk presentation?

A risk presentation needs about 10 slides for a 10-minute slot. With more than five risks to discuss, show the top five and put the rest in an appendix table.

What risk management is: HSE's five steps and the ISO 31000 process

Risk management is the routine of finding what could harm your objectives, judging how likely and how serious it is, controlling it, and checking the controls work. The UK's HSE puts it in five steps for workplaces; ISO 31000:2018 describes a general process of identifying, analysing, evaluating, treating, monitoring and communicating risk.

The UK government's Orange Book, the risk guidance for government departments and arm's length public bodies, defines risk as the effect of uncertainty on objectives (Orange Book, 2023 edition). That is why slide 1 names the objective.

HSE says controls must be reviewed to make sure they are working (HSE). On iso.org, ISO 31000:2018 is listed as edition 2, published February 2018, last reviewed and confirmed in 2023, with a revision under development; ISO says it provides guidelines and is not a certifiable standard (ISO).

How to calculate a risk score: likelihood × impact

To calculate a risk score, rate the likelihood that the risk happens on a 1–5 scale, rate its impact if it happens on a 1–5 scale, and multiply the two: score = likelihood × impact, from 1 to 25. Write the scales down with definitions.

NIST's guide for risk assessments describes risk as typically a function of the adverse impact if an event occurs and the likelihood that it occurs (NIST SP 800-30 Rev. 1, September 2012). It adds that assessments are more repeatable when each value is annotated with its reasons, so keep a one-line reason per score in the register.

The likelihood scale

Define likelihood as a probability per year, so a "4" means the same for every owner. These bands are our example.

The impact scale

Define impact in the unit your committee uses, usually money, plus people and regulation. Size the money bands to the organisation; these fit a single plant.

Likelihood and impact matrix

A likelihood and impact matrix is the grid made by the two scales: likelihood on one axis, impact on the other, each cell holding the product. Keep the two separate: a risk is not "high" because it is frightening.

Risk score formula with velocity

Some teams add velocity, how fast the impact arrives, as a third factor. Show it as its own column ("hours", "weeks") rather than multiplying it in; a third multiplier stretches the range to 125.

What is a 5×5 risk matrix? Bands, the 14 possible scores and colours

A 5×5 risk matrix is a grid of five likelihood levels by five impact levels, where each of the 25 cells holds a score from 1 to 25 and a band such as low, medium, high or very high. Because the score is a product of two whole numbers from 1 to 5, only 14 different scores can ever appear.

We counted every cell of a 5×5 grid. The 25 cells produce these scores, and no others: 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20 and 25. There is no 7, 11, 13, 14, 17, 18, 19, 21, 22, 23 or 24. So a band written as "10–14" really means 10 or 12, and "15–25" means 15, 16, 20 or 25. Write the bands on those real values.

The rare catastrophe problem

Multiplication treats a rare catastrophe (1 × 5 = 5) the same as a near-certain nuisance (5 × 1 = 5). Add one rule: any risk with impact 5 goes to the committee whatever its score. NIST's own Table I-2 avoids the problem a different way: it combines likelihood and impact with a lookup table rather than multiplication, so a very high likelihood with a very low impact stays very low risk, while a very low likelihood with a very high impact is rated low (NIST SP 800-30 Rev. 1, Table I-2).

Risk heat map: colours that still work in black and white

A risk heat map is the matrix with cells coloured by band, and its red and green fail in greyscale and for colour-blind readers. Print the score in every cell, use four shades of one colour, darker as the band rises, and name the bands in a legend.

Semi-quantitative scales: NIST's 0–100 ranges

If your organisation reports on 0–100, use NIST's published ranges (Table I-3, in Key numbers above) and say so on the method slide, rather than inventing a new set.

3×3 vs 5×5 risk matrix: when the simple version is better

A 3×3 risk matrix has three levels each for likelihood and impact (low, medium, high) and produces only six distinct scores: 1, 2, 3, 4, 6 and 9. It is better for a first assessment, a small team or a site toolbox talk; a 5×5 is better when you must rank more than a dozen risks or show movement after controls.

Use the same matrix for every risk and every review, or the trend column means nothing.

The risk register slide: what to show and what stays in the spreadsheet

A risk register is the list of all identified risks with, for each one, a cause, the risk event, its effect, an owner, its scores, its controls and its actions. The register slide shows only the top five rows and five columns.

"Supplier risk" is a topic; "our only packaging supplier fails, so the lines stop for three weeks" is a risk the committee can score.

Risk register vs risk management plan

A risk management plan is the rulebook: the scales, the bands, the appetite, who owns what, and how often risks are reviewed. A risk register is the list the rulebook produces: every risk with its scores and actions. In project management, a RAID log combines risks with assumptions, issues and dependencies; present its risk rows the same way.

Inherent vs residual risk: one slide with the control in between

Inherent risk is a risk's score before any controls; residual risk is the score that remains after the controls in place or planned. Showing both tells the committee what each control buys.

The total falls by 51 − 30 = 21, and 21 ÷ 51 = 41.2%. Scores are ordinal (a 10 is not "twice as bad" as a 5), so use that percentage only as a one-line summary, never as money. Four controls lower likelihood (R1 from 4 to 2, R2 from 3 to 2, R3 from 3 to 2, R4 from 2 to 1) and one lowers impact (R5 from 5 to 3). R2's impact stays at 5 because a successful attack would still stop production until systems are restored. Say which factor each control moves; it is the question a good committee asks.

R5 shows why the impact-5 rule matters: at 1 × 5 = 5 it would sit with routine risks. R2 is still high at 10 after controls, so the example's slide 9 asks for a recovery drill. Backups and drills cover recovery; for the staff habits that make an attack less likely, our cybersecurity awareness presentation guide has the employee session.

Expected loss and the cost of mitigation: the money slide

Expected loss is the annual probability of a risk happening multiplied by the loss if it happens. For the top risk, compare the expected loss with and without the proposed control, then subtract the control's annual cost; the result tells the committee whether the control pays for itself.

Kestrel's R1, the single packaging supplier, works like this. If the supplier fails, the plant loses three weeks of output, valued at $450,000. Without a second supplier, the chance in the next 12 months is 20% (likelihood 4 on the scale above):

The break-even probability

Add one line that answers the sceptic: how wrong could the 20% be before the control stops paying? The control pays while the cut in probability × $450,000 exceeds $28,000, so the cut must exceed 28,000 ÷ 450,000 = 0.062, or 6.2 percentage points. If the true chance today is about 11.2% or more (5% + 6.2 points) and the second supplier brings it to 5%, the control still pays.

Risk appetite statements: one sentence per category

A risk appetite statement says how much risk an organisation is willing to take, in each category, to reach its objectives. On the slide it is one sentence per category with a threshold the scores can be checked against, such as "no residual risk above 4 for food safety".

The Orange Book makes setting it a board task: the board should determine and continuously assess the nature and extent of the principal risks the organisation is exposed to and willing to take, which is its risk appetite (Orange Book, section A3).

With these on slide 1, R2's residual 10 is visibly above Kestrel's technology limit of 9.

How to present risks and mitigation: four decisions

To present risks and mitigation, give each top risk one line of cause and effect, its score before and after the control, the control's cost and owner, and one of four decisions: accept, reduce, transfer or avoid. Without a decision, it is a status report.

The Orange Book's list is a little longer: avoiding the risk, taking or increasing it to pursue an opportunity, retaining it by informed decision, changing the likelihood, changing the consequences, and sharing it, for example through contracts (Orange Book, section D6). The four words above fit on a slide.

Write the mitigation as a dated action

"Improve cyber resilience" is an intention. "Recovery drill on 18 February 2027; owner: IT manager; pass if production is back within 24 hours" is a mitigation.

Enterprise risk management presentation to the board: top five, trend, decisions

An enterprise risk management presentation to a board shows the top five principal risks with their residual scores against appetite, the trend since the last meeting, and the decisions only the board can take. Boards read the pack in advance, so lead with changes, not method.

• Lead with what changed: new risks, risks that crossed an appetite line, closed risks.
• Show trend: an up, down or flat marker beside each residual score.
• Move method to the appendix: the board approved the scales once.
• Name the decision per risk, with its cost, and end with the next review date.

For the rest of the board pack, our board meeting presentation guide covers the full deck. If the board is weighing risks alongside strengths and opportunities in a strategy review, the SWOT analysis presentation shows where the threats quadrant ends and the risk register begins.

Project risk management presentation: the probability and impact matrix

A project risk management presentation shows the project's top risks to the sponsor or steering group, scored on a probability and impact matrix, with a response, an owner and a trigger for each.

In PMP exam preparation the grid is called a probability and impact matrix; it is the same likelihood × impact grid. Project decks differ in three ways:

• Impact in project units: weeks of delay and budget overrun.
• A trigger per risk: the event that says the risk is happening ("vendor misses the pilot date").
• Contingency linked to risks: the budget reserve sized to the top risks' expected cost.

Put the top three to five project risks on your status report, not a separate deck: our project status report presentation guide has the one-slide format and RAG rules. When the risks sit inside a funding request, the business case presentation guide shows how to carry them into the options appraisal.

In some regulated sectors, risk management is a legal requirement. For US medical device makers, FDA's Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference; FDA says this now makes risk management a specific requirement (FDA, QMSR).

Risk assessment presentation for the workplace: HSE's five steps (UK)

A workplace risk assessment presentation walks through HSE's five steps for one site or task: the hazards found, who might be harmed and how, the controls in place and the further actions needed, what is recorded, and when it will be reviewed. In the UK, an employer with 5 or more employees must record the significant findings.

HSE's wording is short: "If you employ 5 or more people, you must record your significant findings" (HSE). The findings it lists are the hazards, who might be harmed and how, and what you are doing to control the risks. That gives the slide order.

1. Hazards: what may cause harm, found by walking the site with the workers.
2. Who and how: the groups at risk (new starters, night shift, contractors, visitors) and the way each could be harmed.
3. Assessment: how likely harm is and how serious, scored on your matrix, often a 3×3 at site level.
4. Controls: HSE's first question is whether you can get rid of the hazard altogether; if not, how to control the risk so harm is unlikely. Protective equipment comes last in its list of controls.
5. Actions: who does what by when.
6. Record and review: where the record lives and the review date, plus early-review triggers: changes to staff, a process, or the substances or equipment used, or an accident or near miss.

This is a UK rule; other countries set their own duties, and this guide is not legal or safety advice. The same six-slide order works for a health and safety course presentation built on the five steps.

To brief a shift on one hazard before the full assessment, our safety moment ideas with a 5-minute format give a topic for every week. When an accident or near miss triggers the review, find the cause before you re-score: the root cause analysis presentation guide compares seven methods, from 5 Whys to fishbone.

The January risk review: using the world's risks as context

A January risk review re-scores every risk, closes what is gone, adds what is new and resets the appetite. One context slide on the outside world helps find blind spots, if it leads back to your own register.

Global Risks Report 2026: what to take from it

The World Economic Forum published the Global Risks Report 2026, its 21st edition, on 14 January 2026, built on a survey of over 1,300 experts (WEF, Global Risks Report 2026). Three findings suit a context slide:

• Most likely trigger of a global crisis in 2026: geoeconomic confrontation, chosen by 18% of respondents, followed by state-based armed conflict at 14%.
• Two-year outlook (to 2028): geoeconomic confrontation ranked first and misinformation and disinformation second.
• Ten-year outlook (to 2036): extreme weather events ranked first, and half of the top 10 risks are environmental.

WEF also found 50% of respondents expect a turbulent or stormy outlook over the next two years, rising to 57% over ten years. Use it to ask which of these touches your supply chain, customers or systems, and show the answer as rows in your register; a global ranking is not a score for your plant. Check WEF's site for the 2027 edition before your review.

A risk-tier law as an example: the EU AI Act

The EU AI Act sorts AI systems into four risk levels: unacceptable, high, transparency and minimal or no risk. It entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. The AI Omnibus, in force since 27 July 2026, extended the rules for high-risk uses in Annex III to 2 December 2027, and the rules for high-risk AI in Annex I products have a transition period until 2 August 2028 (European Commission, page updated 19 October 2026). An EU company using AI in hiring would add a compliance row with the 2027 date.

For the plan and budget that the risk review feeds, our annual plan and budget presentation guide shows how the risks-and-decisions slide sits in the annual plan.

Risk management presentation example: Kestrel Foods, slide by slide

Kestrel's plant risk review is 10 slides in 10 minutes, presented by Hana Okoye to the operations committee on 14 January 2027. Every number comes from the register.

1. Plant risk review: five risks, three decisions for the operations committee (1:00): Kestrel Foods, Riverside plant; 14 January 2027.
2. We score every risk as likelihood 1–5 × impact 1–5 (1:00): very high 15–25, high 10–14, medium 5–9, low 1–4; any impact-5 risk comes to this committee.
3. Two risks start in the very high band (1:30): packaging supplier failure 16; ransomware 15; key engineer leaves 9; labelling rule 6; warehouse flood 5.
4. One control for each of the five risks (1:30): second packaging supplier; patching plus offline backups tested monthly; two technicians cross-trained; label template ready; insurance and raised racking.
5. After controls, no risk is in the very high band (1:00): supplier failure 8; ransomware 10; key engineer 6; labelling rule 3; flood 3.
6. The total score falls from 51 to 30 after controls (1:00): a 41.2% reduction, used as a summary only.
7. A packaging supplier failure would cost $450,000; expected loss is $90,000 a year (1:00): 20% chance today; $22,500 a year at 5% with a second supplier.
8. A $28,000 second supplier saves a net $39,500 a year (1:00): expected loss cut by $67,500; break-even if it cuts the chance by 6.2 points.
9. Ransomware is still high at 10, above our technology limit of 9 (0:30): recovery drill on 18 February 2027; owner: IT manager.
10. Three decisions today (0:30): approve the second supplier; approve the recovery drill; accept the other three risks at their residual scores; next review 15 April 2027.

The times add up: 1 + 1 + 1.5 + 1.5 + 1 + 1 + 1 + 1 + 0.5 + 0.5 = 10 minutes. The appendix holds the full register of 23 risks.

Here are two slides from this article's worked example, as NOXI built them, unedited.

Pass/fail checklist before you present your risks

Run this check before you send the pre-read: each line passes only if its condition is true.

3 AI prompts for a risk management presentation

Use them in NOXI after attaching your risk register, or in any AI tool that accepts files. Replace the brackets; the tool should arrange your scores, never invent them.

How to build a risk management presentation in NOXI

NOXI builds the slides from your risk table: the register becomes the tables and charts on the slides, and you edit any slide by chat. It is free, with no card and no watermark; uploading files needs a free account, and a full deck uses about 25 of the 1,000 monthly credits.

Frequently asked questions

What should a risk management presentation include?

A risk management presentation should include the objective at risk and the appetite, the scoring method, a matrix of the top risks, the top five with owners, scores before and after controls, the top risk in money, actions with owners and dates, what changed since the last review, and the decisions needed. The full register goes in the appendix.

How do you calculate a risk score?

Rate likelihood on a written 1–5 scale, ideally as a probability per year, and impact on a 1–5 scale in money, people or regulation. Multiply them: score = likelihood × impact, from 1 to 25. Record a one-line reason for each rating, and use the same scales for every risk and every review so scores stay comparable.

What is a 5x5 risk matrix?

A 5x5 risk matrix is a grid of five likelihood levels by five impact levels whose 25 cells hold scores from 1 to 25, grouped into bands such as low, medium, high and very high. Only 14 distinct scores can occur: 1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20 and 25.

What is the difference between a 3x3 and a 5x5 risk matrix?

A 3x3 risk matrix uses three levels each for likelihood and impact and produces six distinct scores, so it is quick and suits site checks, small projects and students. A 5x5 uses five levels each and produces 14 distinct scores, so it ranks larger registers and shows the effect of a control more clearly.

What is the difference between inherent and residual risk?

Inherent risk is the score of a risk before any controls, in the raw state of the activity. Residual risk is the score that remains after controls. For example, a supplier failure scored 4 × 4 = 16 can fall to 2 × 4 = 8 once a second supplier is qualified. Residual risk is compared with appetite.

What is a risk register?

A risk register is a list of an organisation's or project's identified risks, with each risk's cause, event and effect, owner, likelihood and impact scores before and after controls, the controls, open actions and review dates. It usually lives in a spreadsheet or risk system, and a presentation shows only its top rows.

What is the difference between a risk register and a risk management plan?

A risk management plan sets the rules: scoring scales, bands, risk appetite, roles and how often risks are reviewed. A risk register is the record those rules produce: every risk with its scores, controls and actions. In a presentation, the method slide summarises the plan and the register slide summarises the register.

What are the 5 steps of risk assessment?

The UK's Health and Safety Executive lists five steps: identify hazards, assess the risks, control the risks, record your findings, and review the controls. In the UK, an employer with five or more employees must record the significant findings. Other countries set their own rules, so check the regulator where you work.

How do you present risks to a board?

Present risks to a board by leading with what changed since the last meeting, then showing the top five residual risks against appetite with a trend marker for each. Name the decision you need per risk, accept, reduce, transfer or avoid, with its cost. Keep the scoring method on an appendix slide the board approved earlier.

Can AI make a risk management presentation from a risk register?

Yes. AI presentation tools can turn a risk register spreadsheet into a structured deck with tables, charts and full-sentence titles. Give the tool your own scores and amounts and tell it to invent none, put the matrix on the slide as a table from your data, then check every score against the register before the meeting.

Sources & methodology

How this guide was made: every world fact comes from the publisher's own page (HSE, NIST, ISO, the UK Orange Book, WEF, the European Commission, FDA). We computed the 14 distinct scores of a 5×5 matrix (and the 6 of a 3×3) by listing every cell. The 10-slide template, timings, scales, bands, appetite statements, impact-5 rule and checklist are editorial recommendations, not published standards. Kestrel Foods and all its figures are fictional; every calculation was checked twice. All sources were checked on 21 October 2026.

• [1] The five steps (identify hazards, assess the risks, control the risks, record your findings, review the controls); employers with 5 or more people must record significant findings; what the findings include; control questions; review triggers; page updated 16 October 2026 — Health and Safety Executive (UK), Risk assessment: Steps needed to manage risk.
• [2] Risk as a function of adverse impact and likelihood; five-level qualitative scales; Table I-2 combining likelihood and impact; Table I-3 semi-quantitative ranges 0–4, 5–20, 21–79, 80–95, 96–100 with values 0, 2, 5, 8, 10 — NIST, Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments (September 2012); status final, NIST CSRC publication page.
• [3] Published 14 January 2026; 21st edition; Global Risks Perception Survey of over 1,300 experts; geoeconomic confrontation 18% and state-based armed conflict 14% as most likely triggers in 2026; two-year and ten-year rankings; 50% and 57% expecting a turbulent or stormy outlook — World Economic Forum, Global Risks Report 2026 (January 2026).
• [4] Four risk levels; entry into force 1 August 2024; applicable 2 August 2026 with exceptions; Annex III high-risk rules extended to 2 December 2027; Annex I transition period until 2 August 2028; AI Omnibus in force 27 July 2026; page updated 19 October 2026 — European Commission, AI Act (regulatory framework for AI).
• [5] ISO 31000:2018, edition 2, published February 2018, last reviewed and confirmed in 2023, a revision under development; principles, framework and process; identifying, analysing, evaluating, treating, monitoring and communicating risks; not a certifiable standard — ISO, ISO 31000:2018 Risk management — Guidelines.
• [6] Scope (government departments and arm's length public bodies); risk as the effect of uncertainty on objectives (Annex 5); the board's role in risk appetite (A3); risk treatment options (D6) — GOV.UK, The Orange Book: Management of Risk – Principles and Concepts (2023 edition; page updated 29 July 2026).
• [7] QMSR effective 2 February 2026; incorporates ISO 13485:2016 by reference, which now specifically requires risk management — US Food and Drug Administration, Quality Management System Regulation (QMSR).

Build your risk management presentation in NOXI, free: attach your risk register, check the scales and the ten titles in Plan mode, and export an editable PowerPoint or a PDF.