Risk matrix

Revision as of 14:50, 21 September 2016

WORK IN PROGRESS

Risk Matrix(Probability and Impact Matrix) is a graphical risk assessment tool to define the different levels of risk as the product of the harm probability categories and harm severity categories. ^[1]

To successfully execute its projects, especially in surrounding unstable environment, the companies, need to be aware about significant uncertainties, which will undoubtedly face projects during different stages of its life cycle regardless its complexity and time completion.

The uncertainties imply risks of (generally adverse) events those effect on the outcome or/and objectives of projects. In order to understand the variety of risks that a project face, Risk Management activities in a project need to be performed. Effective project management need to identify what types of risk may influence particular stage of project. Furthermore, the management have to analyze and prioritize risks in terms of most severity and perform decision making in order to treat the risk and finally treat relevant risks in a structured way in order to avoid or at least mitigate any harm that may cause this certain risk.

However, how to decide and prioritize which risk is more dangerous and need to be treat first?

The one of the useful risk assessment tool supports project management to decide which risk need to be consider at first called “Risk Matrix” or also known as “Probability and Impact Matrix”.

It is a common graphical tool used to simply and quickly visualize and categorize already identified risks, source of risks or risk treatments based on its probability and impact on a project. ^[1]

The aim of current article is to give an overview and summary of Risk Matrix. At the beginning, the article will provide briefly introduction to concept of risk management with its important elements and main idea of Risk matrices. Further article will outline applications of presented toll with further practical usage within Project Management activities. Finally, the strengths and limitations of presented tool will defined.

Introduction

Definition of risk matrix

The main purpose of risk matrix is to classify and prioritize hazard of adverse events based on the level of risk in order to facilitate management to make decision whether certain risks can be admit or whether not. ^[2]

According to ISO 31000 ^[3]the definition of risk outlined as combination of two basis criteria:

1. The consequences or the severity of the impact of an adverse event caused by the risk.

2. The probability or likelihood that this event may occur

In its turn the level of risk or expected loss is defined as multiplication of these two criteria

"Level of Risk=Probability x Consequence”^[2]

The combination of these parameters created risk matrix as two-dimension grid with consequence/impact on one axis (commonly Y-axis) and probability or likelihood on the other (X-axis) as shown on figure 1.

Figure 1. Risk Matrix ^[4]

The severity axis outlines the range of different type consequences and identifies by nominal or textual description such as “limited”, “minor”, “moderate”, “significant” and “catastrophic” as in figure 1.

1. Limited impact: Hazard that will cause a near insignificant amount of harm to the overall progress of the project.

2. Minor impact: If a risk will result in some damage, but the extent of damage is not too significant and is not likely to make much of a difference to the overall progress of the project.

3. Moderate: Risks which do not impose a great threat, but yet a sizable damage can be classified as moderate.

4. Critical: Risks with significantly large consequences which can lead to a great amount of loss are classified as critical.

5. Catastrophic: These are the risks which can make the project completely unproductive and unfruitful, and must be a top priority during risk management.

In its turn the likelihood or probability of the occurrence of a risk can be determines as follows:

1. High: A definite hazard that has highest frequency (generally more than 80 %) of reveal during certain project stages.

2. Medium high: Risks that lies among 60-80% chances of occurrence can be grouped as likely.

3. Medium: Hazard, which have occasional (50/50) likelihood of occurrence harm

4. Medium low: Seldom risk contains low probability of occurrence however can not yet excluded entirely.

5. Low: Unlikely risks, which have a rare level occurrence such as less than 10% ^[5]

Based on combination of probability and impact the level of risk can easily rank by placing into risk matrix according to assigned consequence and probability as shown such as example on figure 2

Figure 2. Allocation of event based on level of risk

Application and use

1. Application

‘Risk matrices have two main applications. The application or aim of the risk matrix is relevant when discussing the suitability of risk matrices. One application is decision-making about the acceptance of risk; the other is to prioritize which risk needs to be addressed first.

Frequently, in risk acceptance, only three levels of risk are distinguished:

- hazards or events with unacceptable risk (often indicated with a red color);

- hazards or events in which the risk is found to be ‘‘broadly acceptable’’, i.e. not requiring further risk reduction (often indicated with green),

- an intermediate level, where risk should be reduced ‘‘As Low As Reasonably Practicable’’ (ALARP, often indicated with yellow).

Given these interpretations, there is no need to further prioritize hazards, at least not in the red and green areas.

In cases where the risk matrix is used for prioritizing (which hazards require most attention in order to reduce the cumulative risk), a larger number of risk levels may be necessary in order to obtain sufficient resolution to rank events or hazards in order of priority.

2. Usage of Risk matrix

The usage of Risk matrix can be determines into five steps as follows: ^[6]

Learning to Prioritize Risks

1. Identify and assess the severity of the impact of an adverse event caused by the risk as illustrated in figure xx.

Figure xx: Severity of the impact ^[7]

2. Estimate the probability of each risk occurring, and assign it a rating as portrayed in figure xx

Figure xx: Probability of the risk ^[7]

3. Explore and map on the level of risk on the Risk Matrix as shown in figure xx

"Level of Risk=Probability x Consequence”^[2]

Figure XX Risk matrix with estimated level of risk ^{[7] [8]}

4. Develop a response to each risk, according to its position in the chart. Remember, risks in the bottom left corner can often be ignored, while those in the top right corner need a great deal of time and attention

5. Based on the level of risk the user makes decision which certain risks can be tolerated or not. ^[7]

For example, in shown example (figure XX) the rank of level of risk up to 4 can be ignored, between 5-12 need to be take into further risk analysis in terms of mitigation of the risk and the rank more than 15 is classified as not acceptable.

Limitations

The aim of any risk evaluation tool is to ensure that the decision process is transparent, based on best knowledge and reflects the common understanding of stakeholders. When reviewing the application of risk matrices, it becomes obvious that this simple tool has some notable weaknesses. Both users and designers of risk matrices should be aware of these shortcomings and ensure that the risk matrices are used in such a way that correct conclusions are drawn.

The mentioned ISO 31010 ^[1] also includes an invaluable summary of the advantages and disadvantages of risk matrices, together with recommendations for their usage.

Strengths:

- relatively easy to use;

- provides a rapid ranking of risks into different significance levels.

Limitations:

- a matrix should be designed to be appropriate for the circumstances so it may be difficult to have a common system applying across the range of circumstances relevant to an organization;

- it is difficult to define the scales unambiguously;

- use is very subjective and there tend to be significant variation between raters;

- risk can not be aggregated (i.e. one cannot define that a particular number of low risks or a low risk identified a particular number of ties is equivalent to a medium risk);

- it is difficult to combine or compare the level of risk for the different categories of consequences(impact)

Results will depend of the level of detail of the analysis, i.e. the more detailed the analysis the higher the number of scenarios, each with a lower probability. This will underestimate the actual level of risk. The way in which scenarios are grouped together in describing risk should be consistent and defined at the start of the study. ^[1]

Annotated bibliography

1. ↑ ^{1.0 1.1 1.2 1.3} [Risk Management - Risk assessment techniques] Dansk Standart DS/EN ISO 31010, 2010
2. ↑ ^{2.0 2.1 2.2} [Recommendation on the use and design of risk matrices'] Nijs Jan Duijm, Safety Science 76, p.21-31, DTU, 2015
3. ↑ [Risk Management – Principles and Guidelines] Dansk Standart DS/EN ISO 31000, 2009
4. ↑ [Definition of risk matrices'] http://www.cgerisk.com/knowledge-base/risk-assessment/risk-matrices
5. ↑ [A Critical Tool for Assessing Project Risk] http://www.brighthubpm.com/risk-management/88566-tool-for-assessing-project-risk/#imgn_0
6. ↑ [Learning to Prioritize Risks] https://www.mindtools.com/pages/article/newPPM_78.htm
7. ↑ ^{7.0 7.1 7.2 7.3} [Usase of risk matrices]http://blog.etq.com/bid/57768/Risk-Assessment-Creating-a-Risk-Matrix
8. ↑ [Keeping Track of Risks With a Project Risk Matrix]http://www.brighthubpm.com/risk-management/96973-keeping-track-of-risks-with-a-project-risk-matrix/

A risk matrices are common used to rank risks, sources of risks or risks treatments on the basis of the level of risk. It is commonly used as a screening tool when many risks have been already identified, for example to define which need to be referred to a higher level of management. It may also be used to select which risks need to be considered further at this time. This kind of risk matrices are also wide used to determine if a given risk is broadly acceptable, or not acceptable according to the zone where it is located on the matrix. The Risk matrices may also be used to help communicate a common understanding foe qualitative levels of risks across the organization. The way risk levels are set and decision rules assigned to them should be aligned with the organization´s risk appetite.