2. Risk Matrices

The risk identification process needs to consider risks of all kinds. Typically, organizations can expect to encounter risks of the following types:

Examples of these risks are outlined in Table 2.2:

Each manager should be responsible for ongoing risk identification and control within their area of responsibility. Once risks are identified, a risk matrix can be developed. Risk matrices will be explained in the next section. The risk management process is the control aspect of those risks that are identified. The adequacy of this process depends on assigning appropriate responsibilities by role for implementation. Effectiveness can be monitored by a risk-screening committee at a high level within the organization that monitors new significant markets and products. The risk review process includes a systematic internal audit, often outsourced to third party providers responsible for ensuring that the enterprise risk management structure functions as designed. One tool to aid in risk assessment and evaluation is a risk matrix.

A risk matrix provides a two-dimensional (or higher) picture of risk, either for firm departments, products, projects, or other items of interest. It is intended to provide a means to better estimate the probability of success or failure, and identify those activities that would call for greater control. One example might be for product lines, as shown in Table 2.3.

The risk matrix is meant to be a tool revealing the distribution of risk across a firm’s portfolio of products, projects, or activities, and assigning responsibilities or mitigation activities. In Table 2.3, hedging activities might include paying for insurance, or in the case of investments, using short-sale activities. Internal controls would call for extra managerial effort to quickly identify adverse events, and take action (at some cost) to provide greater assurance of acceptable outcomes. Risk matrices can represent continuous scales. For instance, a risk matrix focusing on product innovation was presented by Day. ² Many organizations need to have an ongoing portfolio of products. The more experience the firm has in a particular product type, the greater the probability of product success. Similarly, the more experience the firm has in the product’s intended market, the greater the probability of product success. By obtaining measures based on expert product manager evaluation of both scales, historical data can be used to calibrate prediction of product success. Scaled measures for product/technology risk could be based on expert product manager evaluations as demonstrated in Table 2.4 for a proposed product, with higher scores associated with less attractive risk positions:

Table 2.5 demonstrates the development of risk assessment of the intended market.

Table 2.6 combines these scales, with risk assessment probabilities that should be developed by expert product managers based on historical data to the degree possible.

In Table 2.5, the combination of technology risk score of 18 with product failure risk score 26 is in bold, indicating a risk probability assessment of 0.30.

Risk matrices have been applied in many contexts. McIlwain ³ cited the application of clinical risk management in the United Kingdom arising from the National Health Service Litigation Authority creation in April 1995. This triggered systematic analysis of incident reporting on a frequency/severity grid comparing likelihood and consequence. Traffic light colors are often used to categorize risks into three (or more) categories, quickly identifying combinations of frequency and consequence calling for the greatest attention. Table 2.7 demonstrates the use of a risk matrix that could be based on historical data, with green assigned to a proportion of cases with serious incident rates below some threshold (say 0.01), red for high proportions (say 0.10 or greater), and amber in between.

While risk matrices have proven useful, they can be misused as can any tool. Cox ⁴ provided a critique of some of the many risk matrices in use. Positive examples were shown from the Federal Highway Administration for civil engineering administration (Table 2.8), and the Federal Aviation Administration applied to airport operation safety.

The Federal Aviation Administration risk matrix was quite similar, but used qualitative terms for the likelihood categories (frequent, probable, remote, extremely remote, and extremely improbable) and severity categories (no safety effect, minor, major, hazardous, and catastrophic). Cox identified some characteristics that should be present in risk matrices:

Cox argued that risk ratings do not necessarily support good resource allocation decisions. This is due to the inherently subjective categorization of uncertain consequences. Thus Cox argues that theoretical results he presented demonstrate that quantitative and semi-quantitative risk matrices (using numbers instead of categories) cannot correctly reproduce risk ratings, especially if frequency and severity are negatively correlated. Levine suggested that scales in risk matrices are often more appropriately logarithmically scaled rather than linear. ⁵

It would be ideal to go deeper than risk matrices allow, to be able to identify costs and benefits of risk actions. Risk matrices are simple and useful tools because most of the time, detailed cost and probability data is not available. However, if such data is available, more accurate risk assessment is possible. ⁶

Risk can be characterized by the attributes of threat, vulnerability, and consequence, each of which can be expressed in terms of probability. Each of these is uncertain, and in fact these three aspects of risk may be correlated. A normative argument is that if these measures are important but are not known, the organization should invest in obtaining them. Levine demonstrated risk management of computer network security with an example comparing different types of attack in terms of frequency, consequence, and risk. Table 2.9 provides hypothetical data:

In Table 2.9, Risk is defined as the product of frequency and consequence, a common approach. The risk matrix in this case can overlay treatments with cells, as in Table 2.10.

In this case the most attention would be given to identity theft. The others either are relatively low consequence (web vandalism) or relatively low frequency (cyber espionage, denial of service). Looking at the quantitative scale of risk, a bit different outcome is obtained, with cyber espionage and identity theft both being very high, closely followed by denial of service. Web vandalism is lower on this scale. Generally, moving to a more quantitative metric is preferable, with the tradeoff of requiring more data with accuracy an important factor.

To demonstrate, assume the context of a construction firm with a portfolio of ten jobs, involving some risk to worker safety. The firm has a safety program that can be applied to reduce some of these risks to varying degrees on each job. Cox addressed four different levels of risk evaluation, depending upon the level of data available. The risk matrices that we have been looking at require little quantitative data, although as we have demonstrated in Table 2.6, they are more convincing if they are based on quantitative input. Table 2.11 provides full raw data for the ten construction jobs:

In Table 2.11, column 2 is the potential liability due to injury in thousands of dollars. Column 3 is the probability of an injury if no special safety improvement is undertaken. Column 4 is the product of column 2 and column 3, the expected loss without action. Column 5 is the proportion of the injury probability that can be reduced by proposed action, which leads to savings in column 6 (the product of column 4 and column 5). Column 7 is the amount of budget that would be needed to reduce risk. Column 8 (RRPUC) is risk reduction per unit cost.

Table 2.12 gives the risk matrix in categorical terms, using the dimensions of probability of injury {below 0.19; 0.20–0.25; 0.26 and above) and liability risk {below 399; 400–599; 600 and above).

For each combination of injury probability and liability risk has a mitigation strategy assigned. Insurance is obtained in all cases (even for subcontracting). Assigning extra safety personnel costs additional expense. Subcontracting sacrifices quite a bit of expected profit, and thus is to be avoided except in extreme cases. This table demonstrates what Cox expressed as a limitation in that while the risk matrix is quick and easy, it is a simplification that can be improved upon. Cox suggested three indices, each requiring additional accurate inputs.

The first index is to use risk (the expected loss column in Table 2.11), the second risk reduction (savings column in Table 2.11), the third the risk reduction per unit cost (RRPUC column in Table 2.11). These would yield different rankings of which jobs should receive the greatest attention. In all three cases, the contention is that there is a risk reduction budget available to be applied, starting with the top-ranked job and adding jobs until the budget is exhausted. Table 2.13 shows rankings and budget required by job.

If there were a budget of $100k, using the risk ranking jobs 7, 8, 9, and 1 would be given extra safety effort, as well as a 20 % effort on job 6. With the risk reduction index as well as the RRPUC index, a different order of selection would be applied, here yielding the same set of jobs. For a budget of $150k, the risk index would provide full treatment to job 6, add job 4, and 75 % of job 2. The risk reduction index would also provide full treatment to job 6, add job 2, and provide 40 % coverage to job 3. The RRPUC index also would again provide full treatment to job 6, add job 2, and 2/3rds coverage to job 4. The idea of all three indices is much the same, but with more information provided. Table 2.14 shows the expected gains from these two budget levels for each index:

Given a budget of $100k, the risk index would reduce expected losses by $58.08k on job 7, $80.50k on job 8, $48k on job 9, $52.50k on job 1, and $8.856k on job 6, for total risk reduction of $247.936k. As we saw, this was the same for all three indices. But there is a difference given a budget of $150k. Here the risk index actually comes out a bit higher than the risk reduction index, but Cox has run simulations showing that risk reduction should provide a bit better performance. The RRPUC has to be at least as good as the other two, as its basis is the sorting key. The primary point is that there are ways to incorporate more complete information into risk management. The tradeoff is between the availability of information and accuracy of output.

Risk matrices can be applied to capture the essence of tradeoffs in risk and other measures of value. In this case, we apply a risk matrix to a construction industry study where the original authors applied an analytic hierarchy model. ⁷ The model is relatively straightforward. The construction context included a number of types of work, each with a relative rating of supply risk along with a similar weighting of strategic impact. Data is given in Table 2.15:

Figure 2.1 displays a scatter diagram of this data:

Construction contexts could differ widely, but we will assume an operation where the greatest profit is expected from conducting operations normally. Risk can be reduced by spending extra money in the form of added inspection and safety supervisors, but this would eat into profit. The least profit would be expected from an option to outsource construction, placing the risk on subcontractors. The criteria can be sorted in a risk matrix considering both dimensions, as in Table 2.16:

In this case, this policy would result in outsourcing (subcontracting) concrete work, which has a supply risk rating of 0.46 and a very high strategic impact of 0.92. Added risk control would be adopted for ten other types of work: aggregate, steel, infrastructure, sanitary, electrical, mosaic, carpentry, special forming and scaffolding, and stone.

The study of risk management has grown in the last decade in response to serious incidences threatening trust in business operations. The field is evolving, but the first step is generally considered to be application of a systematic process, beginning with consideration of the organization’s risk appetite. Then risks facing the organization need to be identified, controls generated, and review of the risk management process along with historical documentation and records for improvement of the process.

Risk matrices are a means to consider the risk components of threat severity and probability. They have been used in a number of contexts, basic applications of which were reviewed. Cox and Levine provide useful critiques of the use of risk matrices. That same author also suggested more accurate quantitative analytic tools. An ideal approach would be to expend such measurement funds only if they enable reducing overall cost. The interesting aspect is that we don’t really know. Thus we would argue that if you have accurate data (and it is usually worth measuring whatever you can), you should get as close to this ideal as you can. Risk matrices provide valuable initial tools when high levels of uncertainty are present. Quantitative risk assessment in the form of indices as demonstrated would be preferred if data to support it is available.