Every organisation has a handful of contracts that would really hurt if they went wrong. The problem is that hardly anyone knows exactly which ones they are. They are scattered among a hundred other contracts, and the risk is rarely on page one.
A risk matrix solves that. Not as a bureaucratic exercise, but as a way to see in an afternoon where your attention needs to go.
Short answer: sort contract risks into five types (legal, financial, compliance, privacy, operational). Score each risk for likelihood and impact and multiply: tackle high scores first. Choose a strategy per risk (accept, avoid, reduce or transfer) and give it an owner, a deadline and a review date.
Five types of contract risk
| Type | What can go wrong | Examples |
|---|---|---|
| Legal | You are bound by unfavourable or unclear terms | Unlimited liability, supplier's unilateral right to amend, foreign governing law |
| Financial | The contract costs more than expected | Auto-renewal, unchecked indexation, a minimum purchase obligation you can't meet |
| Compliance | You don't meet laws or regulations | Missing data processing agreement, NIS2 supply-chain requirements, sector rules |
| Data privacy | Personal data is not properly protected | Processor outside the EU, no arrangements for breaches or deletion at the end |
| Operational | The service fails or falls short | A single supplier with no alternative, supplier in financial trouble, an SLA that is missed structurally |
The risk matrix: likelihood times impact
Give each risk two scores:
- Likelihood: low (1), medium (2) or high (3)
- Impact: low (1), medium (2), high (3) or critical (4)
Multiply them and you have a score from 1 to 12.
A rule of thumb for what to do with the score:
- 1–2: accept and reassess annually
- 3–4: monitor, for example with a KPI or a fixed review moment
- 6–8: actively reduce, with an owner and a deadline
- 9–12: act now, and escalate to management
Why four levels for impact but three for likelihood? Because the difference between "high" and "critical" impact matters: an outage that costs a day is not the same as one that halts your business. For likelihood, that distinction usually can't be made meaningfully.
Four ways to respond to a risk
| Strategy | What you do | Example |
|---|---|---|
| Accept | You take the risk deliberately, because it is small or the measure costs more than the damage | An indexation slightly higher than expected on a small contract |
| Avoid | You don't enter into the contract or the clause | Don't sign exclusivity; choose another supplier |
| Reduce | You lower the likelihood or the impact | A liability cap, an exit plan, a second supplier on standby |
| Transfer | You place the risk with someone else | Insurance, an indemnity, a bank guarantee from the supplier |
Give every risk you act on an owner, a deadline for the measure and a review date. Without those three, a risk stays a note in a spreadsheet.
Where risks hide in the contract
These clauses deserve a second look in every important contract:
- Liability and indemnity: is there a cap, and does it apply to both parties?
- Penalty clauses and service credits: what do you get, and what might you owe?
- Exclusivity and minimum purchase obligations
- The supplier's unilateral right to change prices or terms
- Auto-renewal and the notice period
- Intellectual property in what is made for you
- Processing of personal data and data breaches
- Force majeure: what does it cover, and what happens then?
- Change of control: what if the supplier is acquired?
- Exit: do you get your data back, and how long must the supplier cooperate?
Getting started in an afternoon
- Pick your twenty most important contracts, by annual value and by how dependent you are on them. Those two lists are often different.
- Go through the clause list above for each contract and note what stands out.
- Give each risk a type, likelihood and impact.
- Choose a strategy for anything scoring 6 or more, with an owner and a deadline.
- Set a review date, and reassess at every renewal in any case.
Performance agreements and risks go hand in hand. A supplier that structurally misses its SLA is an operational risk. So also read monitoring SLAs and KPIs in supplier contracts.
Risk management in Looop
In Looop you record risks on the contract they belong to, in every plan:
- Type, likelihood and impact, with an automatic score from 1 to 12, exactly as in the matrix above.
- The clause where the risk sits, so you don't have to search.
- A strategy (accept, avoid, reduce or transfer) with the concrete measure.
- An owner, deadline and review date, and a flag for high risk or compliance relevance.
- One overview of every risk across your portfolio, sorted by score.
Having risk management and contract management in one system saves more than you'd think: a risk always sits next to the contract, the notice deadline and the supplier's performance.
Frequently asked questions
- What is a contract risk?
- A contract risk is the chance that a contract harms your organisation: financially, legally, operationally, or in terms of compliance or privacy. Think of a supplier going bust, unlimited liability or a processor leaking personal data.
- How do you build a risk matrix for contracts?
- Score each risk for likelihood (low, medium, high) and impact (low, medium, high, critical), and multiply them. That gives a score from 1 to 12. Tackle high scores first; accept low scores deliberately.
- Which clauses carry the most risk?
- Liability and indemnity, penalty clauses, exclusivity and minimum purchase obligations, unilateral amendment rights, auto-renewal, intellectual property, data processing, force majeure and change-of-control provisions.
- How often should you reassess contract risks?
- At least once a year, and always at renewal, when the contract changes, or after an event at the supplier such as an acquisition, a data breach or financial trouble. Give every risk a fixed review date.
