Risk matrix
A risk matrix is a matrix that is used during risk assessment to define the level of risk by considering the category of likelihood against the category of consequence severity. This is a simple mechanism to increase visibility of risks and assist management decision making.
The risk matrix has been widely used across various sectors such as the military, aviation, pharmaceuticals, maintenance, printing and publishing, cybersecurity, offshore operations, electronics, packaging, and industrial engineering. Several recent studies have shown that the assessment of risk matrices has increasingly shifted from qualitative to quantitative methods, particularly in manufacturing and production processes.
Definitions
Risk is the lack of certainty about the outcome of making a particular choice. Statistically, the level of downside risk can be calculated as the product of the probability that harm occurs multiplied by the severity of that harm. However, this method has significant limitations as research has shown that risk matrices based on a simple multiplication can suffer from poor resolution, where they fail to distinguish between risks that are quantitatively very different, especially when the frequency and severity of events are negatively correlated.In practice, the risk matrix is a useful approach where either the probability or the harm severity cannot be estimated with accuracy and precision.
Although standard risk matrices exist in certain contexts, individual projects and organizations may need to create their own or tailor an existing risk matrix. For example, the harm severity can be categorized as:
- Catastrophic: death or permanent total disability, significant irreversible environmental impact, total loss of equipment
- Critical: accident level injury resulting in hospitalization, permanent partial disability, significant reversible environmental impact, damage to equipment
- Marginal: injury causing lost workdays, reversible moderate environmental impact, minor accident damage level
- Minor: injury not causing lost workdays, minimal environmental impact, damage less than a minor accident level
The resulting risk matrix could be:
The company or organization then would calculate what levels of risk they can take with different events. This would be done by weighing the risk of an event occurring against the cost to implement safety and the benefit gained from it.
The following is an example matrix of possible personal injuries, with particular accidents allocated to appropriate cells within the matrix:
| Negligible | Marginal | Critical | Catastrophic | |
| Certain | Stubbing toe | |||
| Likely | Fall | |||
| Possible | Major car accident | |||
| Unlikely | Aircraft crash | |||
| Rare | Major tsunami |
Development
On January 30 1978, a new version of US Department of Defense Instruction 6055.1 was released. It is said to have been an important step towards the development of the risk matrix.In August 1978, business textbook author David E Hussey defined an investment "risk matrix" with risk on one axis, and profitability on the other. The values on the risk axis were determined by first determining risk impact and risk probability values in a manner identical to completing a 7 x 7 version of the modern risk matrix.
A 5 x 4 version of the risk matrix was defined by the US Department of Defense on March 30 1984, in "MIL-STD-882B System Safety Program Requirements".
The risk matrix was in use by the acquisition reengineering team at the US Air Force Electronic Systems Center in 1995.
Huihui Ni, An Chen and Ning Chen proposed some refinements of the approach in 2010.
In 2019, the three most popular forms of the matrix were:
- a 3x3 risk matrix
- a 5x5 risk matrix
- a 4x4 risk matrix
Problems
In his article What's Wrong with Risk Matrices?Thomas, Bratvold, and Bickel demonstrate that risk matrices produce arbitrary risk rankings. Rankings depend upon the design of the risk matrix itself, such as how large the bins are and whether or not one uses an increasing or decreasing scale. In other words, changing the scale can change the answer.
An additional problem is the imprecision used on the categories of likelihood. For example; 'certain', 'likely', 'possible', 'unlikely' and 'rare' are not hierarchically related. A better choice might be obtained through use of the same base term, such as 'extremely common', 'very common', 'fairly common', 'less common', 'very uncommon', 'extremely uncommon' or a similar hierarchy on a base "frequency" term.
Another common problem is to assign rank indices to the matrix axes and multiply the indices to get a "risk score". While this seems intuitive, it results in an uneven distribution.