Risk matrix

What it means

A risk matrix plots risks on two axes: how likely they are and how badly they would hurt. The product sets the order in which they are dealt with - that is its entire purpose.

Each risk carries four things: a description, an owner, a mitigation, and the residual risk once that mitigation is in place. Without an owner and a mitigation the matrix is a list of worries.

A risk is an event that may happen; something that has already happened is an issue and belongs in a response plan, not in the matrix. Nor is the matrix a forecast: likelihood and impact are rough grades such as low, medium and high, and their value lies in forcing risks to be compared with one another, not in the precision of any number.

How it works in practice

In a small company the risks worth mapping are the ones that threaten operations: a key supplier failing, the only person who knows a process leaving, data loss, a large customer not paying, a change in the law.

Mitigations turn into concrete things: a recovery plan, a second supplier, insurance, control points in internal control, an exposure limit per customer.

For financial risks we can feed the matrix figures from the books: what share of revenue the largest customer represents, how old the receivables in the customer ledger are, and how many months of fixed costs the cash would cover. Impact then becomes an amount rather than a feeling, and the next review can measure whether a mitigation worked.

What to watch out for

A risk nobody owns does not get dealt with. And the matrix only works if it is revisited - at least annually and after any significant change in the business, otherwise it stays an appendix to a study nobody opens.

A common mistake is rating every risk medium for both likelihood and impact, so the matrix sorts nothing. The opposite mistake is a mitigation that costs more than the risk: business interruption insurance or a duplicate system pays off only when its annual cost does not exceed the damage it prevents. Small risks are sensibly accepted on purpose, with that decision written down.