Building a Contract Risk Heatmap

What a contract risk heatmap is and why build one A contract risk heatmap is a visual grid that shows where the risk sits across your contracts, so leaders can see the biggest exposures at a glance instead of reading every agreement. Each contract, or each clause, is placed on a grid by two measures, usually likelihood and impact, and coloured from green (low) through amber to red (high). The result is a single picture that answers the question executives actually ask: of all our contracts, which ones should we worry about first. It works at two levels. A portfolio heatmap plots contracts against each other, so you can rank exposure across the book. A clause level heatmap plots the risk inside one contract, so a reviewer can see which clauses are unfavourable before signing. Both use the same method. This is general guidance, not legal advice. Scoring risk is a judgement, so involve the people who own the risk and have a qualified professional review material exposures. ## Step 1: decide what you are measuring A heatmap is only as good as its axes. The common choice is likelihood (how probable is the harm) against impact (how bad if it happens). You can also weight by other factors and fold them into the impact score: - Financial exposure: contract value, uncapped liability, indemnities, penalties.

• Legal and compliance risk: governing law, data protection duties, regulatory exposure, missing or one sided clauses.
• Operational risk: dependency on a single supplier, hard to replace deliverables, tight timelines.
• Relationship and term risk: auto renewal, lock in, change of control, exit difficulty. Pick a small set of factors you can score consistently. Too many and the exercise collapses under its own weight. ## Step 2: score likelihood and impact Use a simple, documented scale so scores mean the same thing to everyone. A 1 to 5 scale works well. - Likelihood 1 to 5: 1 rare, 3 possible, 5 almost certain.
• Impact 1 to 5: 1 negligible, 3 material, 5 severe or existential. Write a one line definition for each level, with a money band for impact where you can (for example impact 5 means loss over a set threshold). Score each contract or clause on both axes. The risk score is likelihood multiplied by impact, giving a range of 1 to 25. ## Step 3: build and colour the grid Place each item on a 5 by 5 grid, likelihood on one axis and impact on the other. Colour the cells: - Green (score 1 to 6): low, monitor only.
• Amber (score 8 to 12): medium, manage and mitigate.
• Red (score 15 to 25): high, escalate and act now. Plot every contract as a dot, or shade a table of clauses by their colour. The clustering tells the story: a crowd of red dots in the top right is where leadership attention and legal resource should go first. ## Step 4: turn colour into action A heatmap that only describes risk is wasted effort. Attach an action rule to each band. - Red: named owner, mitigation plan and a review date; escalate to leadership. Examples of mitigation: negotiate a liability cap, add a termination right, buy insurance, or exit.
• Amber: owner and a watch item; revisit on a set cadence.
• Green: no action beyond normal monitoring. Record the mitigation and re score after it is done, so the map shows residual risk, not just inherent risk. The movement of a contract from red to amber after a renegotiation is the proof that the exercise paid off. ## Step 5: keep it alive Risk is not static. A contract near renewal, a supplier in trouble, or a new regulation can all change a score. Refresh the heatmap on a cadence, quarterly for most portfolios, and whenever a major contract is signed or a material event happens. A heatmap built once and filed away stops reflecting reality within a quarter. ## Common mistakes - Scoring without definitions, so everyone uses the scale differently and the colours mean nothing.
• Measuring only contract value, which misses low value contracts with uncapped liability.
• Inherent risk only, never re scoring after mitigation, so the map never improves.
• No owner on red items, so the scariest contracts have no one acting on them.
• A one time exercise, built for a board slide and never updated. ## One workspace for draft, review, track and govern A contract risk heatmap is straightforward to draw once, and painful to keep current by hand across a growing book of contracts. The deeper problem is that this work is usually split across a drafting tool, a review tool, a spreadsheet of dates, and email threads, so nothing stays connected and knowledge lives in people's heads. A single AI workspace tuned to your company takes a different approach. You draft, understand, edit, track and govern every contract in one place, where each document is modelled as a structured clause tree rather than flat text, so the system can show per clause risk, flag where a draft departs from your standard positions, let you edit a clause in plain language, and keep a live timeline of what changed and when. Because it learns from your own documents and preferred terms, the output sounds like your company rather than a generic template. Adira is built around that idea. A single-pane view of upcoming obligations and overall legal health is on its roadmap. The point is not another tool to check, it is to make the judgement on this page a repeatable company standard instead of something each person re-derives on every deal.