You have a list of fifty different potential compliance risks, from minor employee travel policy slip-ups to massive export control violations. Your budget is limited, and you can't tackle all fifty at once. What tool should you use to map out these risks visually so you know exactly which ones need your immediate attention and budget?

A risk matrix, often referred to as a heat map, is a fundamental tool used in risk management to visually organize and prioritize risks. Compliance departments face a wide array of potential risks but operate with finite resources. To manage these risks effectively, the compliance team must determine which issues require immediate mitigation and which can be monitored over time. The risk matrix accomplishes this by mapping risks along two axes: probability, meaning the likelihood of occurrence, and impact, meaning the severity of legal, financial, or reputational damage. By categorizing risks into low, medium, and high zones based on the intersection of likelihood and impact, the risk matrix allows organizations to allocate resources systematically to high-risk areas. The corporate directory mapping individual employee salaries to their security clearances is incorrect because it has no risk prioritization function. The financial balance sheet tracking monthly depreciation of corporate physical assets is incorrect because a balance sheet is an accounting tool for tracking assets and liabilities, not compliance risks. The public performance dashboard ranking staff members by their individual compliance error rates is incorrect because it is an employee relations and disciplinary issue, and it does not serve as a tool for corporate-level risk assessment and prioritization.