Do we need a risk matrix?

Lately I have been thinking (dangerous I know); is the risk matrix truly useful to communicate the level of risk?  For example, does a High Risk actually mean the risk is high?

When we look at the psychology of risk, you can understand management being on tenterhooks when told there is a ‘High Risk here’ and a ‘High Risk there’. And so the automatic response is to assume that there is a very real chance that the materialisation of the risk is imminent and that the consequences will be significant.

This psychology is supported by a variety of definitions – most notably, the Cambridge Dictionary, which defines High Risk as: involving a greater than usual amount of risk.

But when is a High Risk not actually a High Risk?

In my view – more than you think.

Like every notion I have challenged in risk management (likelihood and ownership to name just two), it hit me like a ton of bricks.

I was doing some work for a water corporation and we were looking at the risk: unplanned release (loss of containment) of water from a dam.  The corporation had a number of dams, and, although some were in partially built-up areas, the majority were in non-populated regions, so the overall consequence was assessed as Major.

Obviously, due to the nature of the risk, the maintenance of the dams was a significant priority. The controls were deemed to be effective (as would be expected) and the likelihood of any such catastrophic release was assessed as Rare.  As a result, given the effectiveness of the controls, there was nothing more that could be done to further mitigate the risk.

The risk was then given a rating using the matrix below:

The risk was, therefore rated as High.  The thing is – that it could never get any lower.  And there in lies the issue with the psychology associated with such a rating.  Could you imagine if this was being reported by the media: Documents show High Risk of dam failure in …..

If they used the following matrix, the risk would be assessed as Medium:

If they used this matrix, the risk would be assessed as Low:

So, what is my point here?

My point is that we make risk informed decisions based on the level of risk that we derive from the risk matrix and we rely heavily on that assessment – but is it a true indication of the level of risk?

In this case, we had a risk where the consequence could not be reduced and there was nothing more that could be done to reduce the likelihood, so is this really a High Risk?

So, is there an alternative?

I believe there is – but as they say in the classic game shows – we will come back to that after the break and I will expand on it in the next newsletter.