By Dane Boers, Senior Reliability Engineer, ARMS Reliability
For more than a decade, the risk matrix has been the go-to decision making tool for assessing risk, and for good reason. The risk matrix is practical, easy to use and flexible enough to apply to various risk types and situations, including:
- Assessing risks of a particular asset
- Deciding which investments or projects have the highest importance
- Choosing which risk controls to implement
Figure 1 Example of a risk matrix).
The purpose of the risk matrix is to simplify the assessment process while still providing meaningful results. Technology and data processing tools now allow for complex assessments using simple interfaces – this plays a major role in supporting the increasing need for improved risk based decision making.
Shortfalls of the risk matrix
Granularity and/or resolution
Risk is not discrete but continuous, and many risks can be similar. Thus, the first shortfall of the risk matrix is that similar risks cannot be separated even though there are known differences. This reduced granularity can result in sub-optimal decisions and missed opportunities for improvement because subtle differences in likelihood or consequence will likely result in the same ‘risk box’ selection.
If you were to prioritise two similar risks with all else being equal, it would make sense to address the slightly higher risk before the lower risk – even though the assigned risk level is the same according to the matrix.
Consider a reduction in the likelihood of an event by 50 per cent, from once in 50 years to once in 100 years i.e. doubling the life of an asset. This is a huge improvement, and may mitigate a significant amount of risk, especially if this is then applied at scale. According to some risk matrixes, the likelihood before and after would be ‘rare’, showing no improvement in risk exposure.
Businesses with large volumes of risk data need to be able to resolve very similar risks to make the best decisions possible, especially when constrained on expenditure or resources. This is even more evident when dealing with large fleets of similar assets and risks.
Alignment
To make effective investment decisions around risk mitigation and exposure, an organisation must be able to compare and trade-off the value from different risk types (e.g. stakeholder risk vs. environmental risk). In a budgetary or resource constrained environment, this is especially important. An organisation must understand which consequences are more important relative to others. A risk matrix partially does this by grouping the consequences into ‘negligible’ or ‘moderate’ groupings, however this does not answer the question of:
If I can spend $1000 and mitigate either a ‘moderate’ stakeholder risk or a ‘moderate’ environmental risk with the same likelihood, which one should I do?
The matrix type framework is not flexible enough for most organisations to achieve exact alignment of risk types.
X by Y grid and descriptions
When thinking about consequences, the risk ‘levels’ must be meaningful to be constantly applied. This is why safety risks are often thought about in terms of ‘first aid’, ‘medical treatment’, ‘disabling’ or ‘fatal’ injuries. These can be measured and conceptually linked to an event as the most likely outcome. The ‘negligible’ and ‘moderate’ descriptions aren’t meaningful enough.
In the safety risk example above, there are four consequence levels. What if an environmental risk type is introduced into the matrix and it only has three consequence levels (e.g. ‘<100L spill’, ‘100L-500L spill’ and ‘>500L spill’)? Because the number of meaningful levels can be different between risk types, they cannot fit into an X by Y matrix without distortion.
The solution: ‘The Value Framework’
Identify what is important to your organisation (value measures)
The first step in creating a value framework is to identify the things that your organisation values or considers to be important. An existing risk management framework or risk matrix is a good place to start. Risk types (e.g. safety, environment, stakeholder, legal and compliance) are common values that can be measured and are found in most value frameworks.
Benefits such as financial returns, increases to employee efficiency, and so on are also important and should be included. Another common inclusion in a value framework is strategic targets, KPIs or other measures. Everything identified in this step is known as a ‘value measure’.
Identify the common levels and calculations
Each ‘value measure’ obviously needs to be measured. The next step is to determine the discrete levels for each measure (e.g. for safety, they could be ‘first aid’, ‘medical treatment’, ‘disabling’ or ‘fatal’ injuries). Then add calculations for KPIs or values like ‘employee efficiency’ where an exact value can be obtained.
For example, employee efficiency = number of employees affected x hourly rate x hours saved per employee.
Multiple risks transparency
The next shortfall of the typical risk matrix is the ability to handle and interpret events that cause multiple similar consequences.
Consider an equipment failure that causes a large amount of smoke in a building. The result may be that 50 people require medical treatment for smoke inhalation. If a single medical treatment injury is assessed as a ‘moderate’ safety consequence, at what point does the sum of these injuries constitute the equivalent of a ‘critical’ or ‘catastrophic’ consequence? E.g. 10, 50, 100 persons?
Without the ability to summate or determine a total risk for an event, low impact but high-volume consequences could leave your organisation exposed.
Cost benefit
Assessing risk based purely on outcome risk levels is only one half of the equation for making effective decisions. The usual risk matrix methodology prioritises the highest risk levels first, with little regard for the cost to achieve the mitigation. Because organisations have limited resources, determining the best way to utilise these resources is key to remaining competitive in the marketplace. The missing component is cost (monetary or otherwise), and without a cost component we are unable to answer the following question;
If I can mitigate one of two ‘moderate’ safety risks with the same likelihood, which one should I mitigate?
Once you identify that mitigation of the first risk costs 50 per cent less in dollars, time and resources, the decision becomes clearer. The answer to this critical question is missing from most risk matrixes and risk frameworks.
Alignment
Once the value measures and their calculations have been identified, they need to be aligned to a common scale. This is to allow a non-biased trade-off between any of the measures in the framework. Typically, this common scale is dollars or a dollar equivalent unit. Every level and calculation of every value measure needs to be quantified. For most risk types, this is calculated as the direct cost or benefit to the organisation.
For example, the cost to the organisation for a safety medical treatment injury (MTI) would be:
$10,000 penalty cost + $1,000 legal cost + $1,500 compensation cost = TOTAL $12,500
Application
Now that we have a rational and consistent way to assign a value to every risk, benefit, cost and other measure that an organisation values, the value framework can be used to assess every investment the same way.
Figure 2: What a Value Framework could look like.
Summary
The risk matrix is a great tool for rapid risk qualification, but it cannot be used effectively to make risk and value based decisions. More information is required.
Organisations today need to:
- Differentiate large volumes of risk, and risks with extremely small likelihoods
- Evaluate and totalise multiple risks
- Incorporate costs into risk-based decision-making processes
- Trade-off one risk type for another achieving a better overall economic outcome
- Have a framework that accomplishes all the above with consistent application and transparency
Creating a value framework meets these requirements and allows organisations to make effective value based and risk informed decisions
This partner content is brought to you by ARMS Reliability. To learn more about creating a value framework, download the executive whitepaper Value Based Decision Making.
