Which of the following is a risk matrix?

A database of risks associated with a specific information system describes a risk register or risk inventory, not a risk matrix, which is a visual plotting tool rather than a data repository.

A table of risk management factors for management to consider describes a risk register or risk reporting artifact, not a risk matrix, which specifically maps likelihood against impact in a two-dimensional grid.

A risk matrix is formally defined as a two-dimensional representation that typically places likelihood (probability) on one axis and consequence (impact/severity) on the other axis, creating a grid. This visual format allows organizations, project teams, or product managers to quickly assess and prioritize risks based on their combined likelihood and impact scores.

A tool for determining risk management decisions describes a decision support framework or risk assessment methodology broadly, whereas a risk matrix is specifically a two-dimensional visual representation used to categorize and prioritize risks, not to prescribe decisions.