What is a risk matrix?

A risk matrix is a visual tool that allows employers, managers and supervisors to visualise the risks that threaten a business. It depicts the likelihood of a risk materialising and the impact the risk will have on the organisation. Risks are sometimes unknown and businesses are unprepared to handle them.

To understand the level of risk, internal and external research can be conducted, experts can be consulted and employees can help by providing feedback. By picturing both elements, it is easier to determine whether a business can be operated successfully and the steps needed to be taken for that to happen.

How does the risk matrix work?

A risk matrix will usually include colours, red, orange, yellow and green to indicate how important a risk is and the urgency in which it needs to be addressed. It has two axes, one for the probability and one for the impact of the risks. Red can be chosen for an area with critical impact while green is usually chosen for areas with a low impact. Yellow can depict the medium risks and orange can show the high risks. More than four colours can be used if deemed necessary.

People conducting a risk analysis can decide on how to set the likelihood of an event based on their analysis. Very high, high, medium and very low labels can be used to describe the levels of probability of a risk occurring. For example, 0% to 10% could be a very low likelihood while 90% to 100% could be a very high likelihood. The event in which a risk materialises depends on many factors, such as the economy, so the probability will not be the same for every risk and every organisation.

How to make a risk matrix

Before designing a risk matrix, it is important to understand the size, budget and industry the business is in. This will allow for risk criteria to be created, against which the risk can be compared to determine whether it can be classified as a risk to the business. Every company will have its own criteria which will show whether it is affected by a threat or not. A risk analysis can be performed to identify the risks that affect the company. After the risk analysis, a risk evaluation can follow to assess whether a risk can be controlled, eliminated or accepted.

Establishing the likelihood of risk is a slightly complex process. Industry data, feedback from employees and expert consultations can be needed to get the most accurate result. Internal and external research is necessary to make the probability more precise. Qualitative and quantitative measures can be used to determine the likelihood of an event occurring.

A similar process needs to be followed to evaluate the impact of a risk. Once the likelihood has been established, it is important to look at the measures that are in place to handle that risk. If there are adequate control measures then the risk can be controlled. If they are not, then the consequences of the risk materialising need to be considered. The results might be invisible or catastrophic. Depending on the measures, the likelihood and the consequences, a risk rating is given that is reflected by the colour, either green, yellow, orange or red.

The effort invested into making a risk matrix determines its effectiveness so all information needs to be looked at thoroughly. A risk matrix can be created in different software such as Excel.

Why is the risk matrix important?

A risk matrix has many benefits.

• Simplicity
• Prioritisation
• Mitigation strategies
• Completion of projects

Simplicity

A risk matrix is a simple but effective tool. People within the business to visualise the risks they are dealing with or might deal with in the future. Rather than having multiple lines of text it summarises the risk severity and probability in one picture. It provides a very straightforward overview that ensures that more people within the business will understand why a risk is important even if they are not familiar with the language used in risk assessments. 

Prioritisation

By having all tasks organised, managers can see which tasks need to be prioritised. They can see the urgency of addressing certain risks and the severity if they fail to do so. To ensure that risk prioritisation is effective the risk matrix needs to be constantly updated with new risks, probability and the impacts they have on the business. Otherwise, the decisions will be made based on the wrong information.

Mitigation strategies

The risk matrix encourages a proactive rather than a reactive approach. This prevents businesses from unnecessary costs and damage to the business and its reputation. Developing a risk matrix helps as it is supported by the risk evaluation which develops strategies to eliminate or reduce the risk. Controlling and mitigating the risk is the overall goal of the risk matrix.

Completion of projects

Once risks have been identified and analysed strategies can be developed to manage them. This allows projects to be completed successfully and on time. Constantly updating the risk matrix ensures that the project is carried out smoothly as threats are being handled and the business is prepared to deal with them. It can also help in preventing issues within a project that arise from accidents or incidents. For example, thanks to aligning their exercising with their risk matrix, the SNZ managed to attend the Tokyo Olympics during the COVID-19 pandemic. 

Disadvantages

Just like every tool, a risk matrix has its own disadvantages. There are more disadvantages for poorly designed risk matrices but the most common ones are:

• Inaccurate information
• Compressed data
• Lack of timeline

Inaccurate information

A poorly executed risk analysis can paint a very different picture than what is really happening. It can show some risks as being insignificant while in reality, they could pose a great threat to the business. Sometimes the depiction of the risks might not be an accurate visualisation of the impact a risk can have on a business as colours are mostly assigned based on percentages or estimations.

Compressed data

Detailed data are presented in a simple form that can remove important elements from the risk. While this can make the severity and likelihood of the risk easier to understand it can reduce the complexity that comes with risks. Most of the time risks are not simple. They are very hard to address and to mitigate and the risk matrix does not differentiate them clearly. It might also not present how risks are connected with one another and how one risk can affect the final outcome.

Lack of timeline

A risk matrix does not specify the timeline in which risks need to be dealt with. It is just a visualisation of the probability and impact. This can lead to poor decision making as managers and employees just see colours rather than a plan. For example, medium urgency risk might need to be eliminated faster than a high-risk one due to the timeline of a project. If a risk matrix is not updated regularly it can fail to show the timeline in which a risk is changing.

Conclusion

Being organised and identifying vulnerabilities will help the organisation survive in an environment where risks constantly evolve. A risk matrix can be a helpful visual technique to highlight the impact and likelihood of risks but it can only be effective if used correctly. It is also not made for every business. Each manager needs to evaluate whether a risk matrix is appropriate for their business.