I'm not sure on exactly what you're referring to but here's a link to a <a href="http://securityonwheels.blogspot.com/2009/07/good-business-impact-analysis-template.html">good business impact analysis template</a>. It is not important what matrix will you use. It is important everybody using it understands how to do it and how to interpret results. Morover, when you define matrix you have to explain to your management what risk (or impact) level means what for organization so they can decide what is acceptable and what's not.

I'm not sure on exactly what you're referring to but here's a link to a <a href="http://securityonwheels.blogspot.com/2009/07/good-business-impact-analysis-template.html">good business impact analysis template</a>. It is not important what matrix will you use. It is important everybody using it understands how to do it and how to interpret results. Morover, when you define matrix you have to explain to your management what risk (or impact) level means what for organization so they can decide what is acceptable and what's not.