Risk matrices are one way to perform risk-based prioritization. The approach is qualitative, or describes the quality of the risks, and does not specifically measure the risks as we normally think in terms of weights and measures. In some cases, a qualitative approach (good-bad, high-medium-low) is sufficient for allocating resources; however, in other cases, it is not.
If performed, a risk matrix should be performed well regardless of your opinion of qualitative versus quantitative approaches for risk analysis.
Here are eight tips for improving risk matrices:
Supplement the risk matrix with some other risk analysis technique because different approaches should yield similar results.
Communicate the output of the risk matrix as words or colors because any numbers that are produced are not quantities.
Use the full range of the scale because human opinion is centrally biased (we tend to avoid extremes)
There should be a consistent understanding of the scales and they should be consistently applied. (A 10 is a 10, no matter where you find it)
If you disaggregate the likelihood or consequence to get a better basis for the final value, the disaggregated categories should be independent and non-overlapping to avoid double counting or double weighting.
Find the lost art of effective facilitation because conducting a relevant qualitative assessment is a function of survey design, analysis, and administration.
Think and operate in more than two dimensions because likelihood and consequence are simply one way to express risk (the definition of risk is more robust than these two aspects)
Remember the purpose of the risk matrix is primarily as a basic prioritization and communication tool.
Any opinion is a function of context. My context is working directly with decision makers to allocate resources - time and money. There are meaningful gaps in available supporting data. Nonetheless, decisions must be made promptly related to communications, capital expenditures, operations budgets, condition assessments, work prioritization, preventative maintenance (PM) program improvement, inventory management & critical spares, predictive maintenance (PdM) programs, safety improvements, design (and/or re-designs), and even on data collection to improve future risk analysis.
In many ways, I wish the pesky risk matrix would go away. The reality is that it will not. So let's do the risk matrix well since we will continue to use it.
JD Solomon Inc. specializes in solutions associated with facilities, infrastructure, and the environment. Contact us for more information on reliability assessments, risk assessments, and programmatic approaches to meeting your organization's objectives.
