The risk matrix under Brazil’s Law 14.133/2021 is not a generic probability-and-impact spreadsheet. Under the statute, it works as a contractual risk-allocation clause: it defines which supervening events are borne by the Public Administration, which are borne by the contractor, and which may be shared. This allocation helps shape the price, sets responsibilities and affects future claims for restoration of the contract’s economic and financial balance.
A risk analysis, by contrast, is a management activity: it identifies, analyzes, evaluates and treats threats to a successful procurement. A risk map or Risk Management Map, when required by the applicable regulation or methodology, is the document used to record and communicate that work. In short: analysis is a process; the map is a record; the matrix is contractual allocation.
When the risk matrix is mandatory under Law 14.133
Article 22, paragraph 3, of Law 14.133 requires the procurement notice to mandatorily include a risk allocation matrix in two situations:
- large-scale works and services;
- integrated or semi-integrated contracting, regardless of whether the object reaches the large-scale value threshold.
For 2026, Decree 12.807/2025 updated the amount in Article 6, item XXII, which defines large-scale works, services and supplies, to an estimated value above BRL 261,968,421.04. The specific trigger in Article 22, paragraph 3, however, refers to works and services of large scale. The decree took effect on January 1, 2026.
Outside those cases, the matrix is not automatically mandatory under the general rule of Article 22. It may still be adopted when the nature and complexity of the contract justify an explicit allocation of risks. Brazil’s Federal Court of Accounts (TCU) recommends using it whenever formal allocation can improve predictability, legal certainty and the quality of bids.
Risk analysis, risk map and risk matrix: what is the difference?
| Instrument | Main function | Timing and use | Contractual effect |
|---|---|---|---|
| Risk analysis | Identify, understand, assess and treat risks that may jeopardize the procurement or its performance. | Starts during planning and may continue throughout the procurement lifecycle. | Does not, by itself, allocate the economic burden of each event between the parties. |
| Risk map / Risk Management Map | Record and communicate risks, levels, responses, owners and treatment actions according to the applicable methodology. | Used under specific regulations and methodologies; in federal ICT procurement, for example, it is updated throughout the procurement phases. | May provide input for the matrix, but does not automatically become a contractual risk-allocation clause. |
| Risk allocation matrix | Define which contractual risks are borne by the public sector, the contractor or both. | Designed before the tender and, when adopted, must be reflected in the contract. | Forms part of the initial economic and financial balance and guides the resolution of claims related to allocated risks. |
The TCU Procurement and Contracts manual expressly states that the matrix must not be confused with risk analysis. The Court describes analysis as mandatory during planning and the matrix as the clause used when contractual risks need to be formally divided between the parties.
It is also important not to treat the label “risk map” as a universal legal category. Some federal rules, such as those for ICT procurement, use the term Risk Management Map as a recording and communication instrument. Other public bodies may use “risk map” for an internal spreadsheet or form. The comparison should therefore focus on the function of the instrument, not only on its title.
What the matrix must solve in practice
The statutory definition in Article 6, item XXVII, together with Articles 22 and 103, shows that a useful matrix must do more than list risks. It must connect each event to responsibility and contractual consequences.
- Identify relevant supervening events that may affect the economic and financial balance.
- Allocate each risk to the Administration, the contractor or both.
- Provide prevention and mitigation mechanisms when appropriate.
- Consider which party is better able to manage the risk, avoiding arbitrary transfers.
- Quantify the impact of risks so their costs may be considered in the estimated value and in bids.
- Align the matrix with the contract, including rules on restoration of balance, termination and previously defined insurance requirements.
The more risk is transferred to the private party, the larger the risk premium incorporated into the price may become. Risk allocation should therefore not be used merely to “pass the problem” to the contractor; it should seek the most economically efficient solution.
What changes in integrated and semi-integrated contracting
In integrated and semi-integrated contracting, the law imposes a specific rule: risks arising from supervening events associated with the contractor’s choice of the basic design solution must be allocated to the contractor in the matrix. This fits the greater role those regimes give the private party in defining or developing technical solutions.
This does not mean that every project risk may be transferred indiscriminately. Law 14.133 itself requires efficient allocation, compatible with the nature of the risk, the obligations assigned to each party and each sector’s ability to manage it.
How the matrix affects restoration of the economic and financial balance
The matrix helps define the contract’s initial economic and financial balance in relation to supervening events. If a risk was clearly assigned to one party and the stated conditions are met, Law 14.133 requires that allocation to be taken into account when later claims are reviewed.
Article 103, paragraph 5, provides that, when the conditions of the contract and the matrix are met, the parties waive claims for restoration of balance related to the risks they assumed. The statute itself preserves exceptions, including unilateral changes ordered by the Administration in the situations provided by law and increases or reductions, under supervening legislation, in taxes directly paid by the contractor because of the contract.
In practice, a poorly drafted matrix may produce the opposite of its intended effect: more disputes over who should bear the event. Events should therefore be described precisely enough to distinguish foreseeable risk, operational responsibility, facts attributable to one party and situations that may actually justify contract review.
Allocation examples: how to reason without copying a ready-made matrix
| Illustrative event | Allocation question | Possible treatment |
|---|---|---|
| Material geological condition not adequately reflected in the available studies | Which party had better means to investigate, price or control the risk before the bid? | The TCU uses geological risk as an example of an event that may be assigned to the contractor, but the actual solution depends on the studies, the contracting regime and an efficient division of responsibilities. |
| Delay in making available an area whose release depends on the Administration | Can the contractor control the release, or does it merely suffer its effects? | In principle, this risk calls for careful analysis before any transfer to the contractor because the ability to manage it may remain with the public sector. |
| Choice of the basic design solution in integrated or semi-integrated contracting | Who chose the technical solution that gave rise to the event? | Law 14.133 requires supervening risks associated with the contractor’s choice to be allocated to the contractor. |
| Risk for which insurance coverage is available | Is there an insurance market able to price and absorb the event? | Article 103 states that risks for which insurers offer coverage should preferably be transferred to the contractor. |
These examples do not form a universal allocation table. The matrix must be built from the object, the studies, the execution regime, the market and each party’s actual ability to prevent, absorb or mitigate the event.
Common mistakes when preparing the matrix
- Copying the risk map into the contract without adapting it. Not every planning risk needs to become an economic contractual risk.
- Using only a probability-versus-impact heat map. That tool helps assess risks, but it does not replace the clause that defines who bears each event.
- Transferring nearly every risk to the contractor. This may raise prices, reduce competition and create inefficient allocation.
- Failing to quantify material risks. The law links allocation to the impact on the estimated contract value.
- Misaligning the notice, matrix and contract. The contract must reflect the allocation presented in the procurement.
- Using vague event descriptions. Broad wording such as “any unforeseen event” tends to create uncertainty rather than reduce it.
A practical workflow for building the matrix
- Start with the procurement risk analysis. Identify events, causes, consequences, probability, impact and possible responses.
- Separate management risks from contractual risks. Not every threat to the process should be transferred to the economic relationship between the parties.
- Select events that need explicit allocation. Prioritize those that may affect cost, schedule, technical solution or continuity of performance.
- Assess who can best control each risk. Consider available information, prevention capacity, insurance availability and transfer cost.
- Quantify the economic effect where possible. Pricing should connect with the estimated value and the bid structure.
- Define the contractual consequence. Clarify whether the event is absorbed by the responsible party, shared, may justify restoration of balance, is covered by insurance or requires another lawful response.
- Make the matrix consistent with the notice and contract. Allocation should not remain isolated in an annex with no effect on the other clauses.
Official sources for verification
To review a matrix or confirm whether it is mandatory, consult Law 14.133/2021 directly, especially Articles 6, items XXII and XXVII, 18, item X, 22, 92 and 103; Decree 12.807/2025 for the 2026 updated large-scale threshold; the TCU section on the risk matrix; and the section on procurement risk management.
Note: this content is informational. A matrix for a specific procurement should take into account the rules of the relevant public entity, the object, technical studies and the execution regime, with review by the technical and legal teams when appropriate.
