A risk matrix only works when the words on it are the words your people already use. ISMSVision does not lock you to one vendor scale. You name the rows, the columns, and the ratings, and those names are what assessors see when they score a risk.
Rows, columns, and the cell where they meet
Likelihood runs down the matrix. Impact runs across it. The cell where a row and a column meet is the inherent rating: how serious the risk is before treatment. You choose both the axis names and the rating names.
The supplied starting point is a familiar five-by-five scale. Likelihood runs from Rare to Almost certain. Impact runs from Negligible to Severe. Ratings run from Negligible through Critical. You can replace any of those words. A hospital, a software company, and a manufacturer do not have to share a vocabulary to share the product.
Names change what people read, not where a rating sits
Each row, column, and rating band has a fixed position. Renaming the top likelihood row from Rare to Remote changes the label. It does not move existing risks onto a different row. The same is true of rating bands: the internal key stays put, and the display name and colour are what you edit. That is what makes a rename safe after go-live, as long as you still mean the same position on the scale.
Colours follow the band
Each rating band has its own colour. That colour is used on the matrix, on register pills, and on the rating shown in the risk itself. If you rename a band, keep the colour aligned with how urgent that band should feel.
Say what each name means
A name is not a definition. Likelihood criteria let you add columns such as chance, probability, or frequency, with a note for every row. Impact criteria do the same for each column, so Financial and Operational can describe the same Minor or Major in concrete terms. When those descriptions disagree, you write the rule — for example, take the highest likelihood any column supports, or the worst impact across the dimensions.
Word bands or scores
Basic mode stores the rating as a word band in each cell. Enterprise mode stores a score from 1 to 25 and can attach a priority, so three risks that all read as Critical can still be ordered. Both modes use the names you configured. The score does not replace the label. It sits alongside it.
Start from an example, then make it yours
A new account can import an example matrix instead of beginning from a blank grid. Import is a starting point. After it lands, rename the labels, rewrite the criteria, and adjust the cells so the register matches the scale in your risk method, your board pack, or your standard.
The same idea runs through the rest of risk configuration. Risk types, statuses, and sources are lists you name yourself. The matrix is the part that also drives the rows, columns, and colours of the rating itself.