We’re surrounded by risk but not all risk is created equal, and that’s where this matrix comes in.
A Risk Matrix is a visual way to represent risk by mapping the probability of its occurrence versus its impact.
It’s a common tool in risk assessment that supports visibility and communication around potential risks as a starting point to discuss mitigation strategies. It’s also a useful co-design tool, empowering a group of people to identify and position risks on the matrix.
The elements on each matrix can vary as required, sometimes even specifying a monetary amount for impact and a percentage for probability. More often, rather than a strict calculator, it’s used indicatively and uses consequences ranked by negligible, marginal, critical, and catastrophic; and likelihood ranked by rare, unlikely, possible, likely, and certain.
IN YOUR LATTICEWORK.
I like to think of this matrix as the love child between Inversion and Probabilistic Thinking — and it's suitably powerful as a result. You might also want to consider it in the context of Redundancy/ Margin of Safety.
- Brainstorm possible risks.
Ideally consult broadly to identify possible risks, including analysing relevant data, customer complaints, external examples and considering both internal and external factors.
- Rank risks by consequence.
Consult and research as required to identify the consequences, damage, or impact, of the identified risks. Understanding the impact if they do occur.
- Rank risks by likelihood.
Consult and research as required to identify the likelihood of the identified risks.
- Consider response and mitigation.
Use the finished matrix to drive a conversation about mitigation plans and risk management options with a focus on the high impact and high likelihood risks.
- Monitor and update.
An often forgotten point is the need to continually monitor risks and update the matrix accordingly.
Electric energy organisation.
This academic paper from Science Direct describes a relatively robust approach taken to a risk analysis of an electric energy organisation. View the link to see the full paper, but the risk matrix is captured below.
Risk Matrices are simplified representations and as such do not capture the nuances of various risks, in particular they do not consider change of risk factors over time. They are also often generated through a consultative and co-design approach with a focus on qualitative interviews over quantitative data, which can lead to issues with cognitive bias and human error.
Coming from risk assessment, a risk matrix might be part of a project management toolkit and used at the commencement of a project.
Use the following examples of connected and complementary models to weave risk matrices into your broader latticework of mental models. Alternatively, discover your own connections by exploring the category list above.
- Probabilistic thinking: a fundamental way of approaching a challenge that lies behind a risk matrix.
- Inversion: in considering what could go wrong.
- Pareto principle: to identify key risks to worry about.
- Second order thinking: to consider the impact beyond the initial event.
- Agile methodology: to test out ideas rather than commit to a long term, fixed plan.
- Risk minimisation framework: to gain courage in considering options, even with risks.
Napoleon has been credited with establishing a risk matrix with the consideration of likelihood versus consequences, though we’ve been unable to confirm this and have not attributed the model as a result (though I'd like to think that Napolean was behind this).
Oops, That’s Members’ Only!
Fortunately, it only costs US$5/month to Join ModelThinkers and access everything so that you can rapidly discover, learn, and apply the world’s most powerful ideas.
ModelThinkers membership at a glance:
“Yeah, we hate pop ups too. But we wanted to let you know that, with ModelThinkers, we’re making it easier for you to adapt, innovate and create value. We hope you’ll join us and the growing community of ModelThinkers today.”