What is a reputational risk matrix and how to build one

Not every situation that mentions your brand online deserves the same reaction. A reputational risk matrix is the tool that organizes that prioritization: it classifies each type of situation by how likely it is to happen and how much reputational impact it would have, so the communications team can decide with judgment where to focus attention.

The matrix's two axes

The classic structure crosses two variables in a two-way table:

• Probability: how likely the situation is to occur (low, medium, high), based on the company's and industry's history.
• Reputational impact: how severe the damage to brand image would be if it happens (low, medium, high, critical).

Crossing both variables produces four quadrants: what should be passively monitored (low probability, low impact), what needs a protocol prepared in advance (high probability, high impact), and two intermediate quadrants that require case-by-case judgment.

How to identify your company's sensitive topics

Before building the matrix, list the specific topics that could affect your organization — not generic industry ones, but the real ones from your operation: a history of recurring complaints, a pending regulatory issue, a business decision that caused noise in the past. This list comes from reviewing at least the last 12-24 months of negative mention history.

An example matrix in practice

Situation	Probability	Impact	Preparedness level
Isolated customer complaint on social media	High	Low	Standard customer service response
Service failure affecting a whole area	Medium	High	Crisis protocol with a designated spokesperson
Customer data breach	Low	Critical	Crisis committee + legal counsel from minute one

Why this isn't a paper exercise: the real cost of not having one

The numbers behind this are stark. According to Aon's 2025 Global Risk Management Survey — nearly 3,000 leaders across more than 60 countries — "damage to reputation or brand" ranks among the world's top 10 business risks, yet only 14% of organizations actually quantify their exposure to their own top-10 risks. Most companies manage reputational risk blind, with no matrix to organize it.

Why it's worth fixing that blind spot: according to Echo Research's UK Reputation Valuation Report 2025, reputation now accounts for 29% of FTSE 350 market value — roughly £730 billion — so the risk a matrix helps manage isn't abstract, it's company value, plain and simple. And when that risk actually materializes into a crisis, SenateSHJ's Crisis Index 300 — which analyzed over 300 crises across 27 stock exchanges and 32 industries over 40 years — found share prices drop by an average of 35.2% and take 427 days to recover. A well-built matrix doesn't eliminate that risk, but it's the difference between responding with a protocol already written and improvising through those 427 days.

From matrix to action protocol

The matrix alone protects no one — its value lies in every high-impact quadrant having a response protocol already written before the crisis happens: who's the spokesperson, which channels activate first, and what minimum information needs to be ready to communicate within the first hour. Improvising that response in the middle of a real crisis is the main reason a manageable situation turns into major reputational damage.

Integrating the matrix into daily monitoring

A risk matrix that's only reviewed once a year isn't very useful. The team doing digital media monitoring day to day should have the matrix on hand to classify every new mention against the quadrants already defined, instead of evaluating each situation from scratch.