Risk Matrix · Risk Management
Risk Matrix / Risk Management
What is a risk matrix?
- Rank risks by likelihood × impact
- Four responses: avoid, reduce, transfer, accept
- A risk register only works if you keep it updated
What risk management really changes is the language used in meetings. A remark like "that seems risky" can be neither challenged nor verified, and leaves no record. But the moment it is written as "likelihood medium, impact high, owner: Procurement, due end of March," that risk becomes something managed. What a risk matrix does is turn vague anxiety into items with an owner attached. In the first year of adoption, what changes first is not the number of incidents but the fact that a record remains of who had agreed to handle what when something goes wrong.
In practice, a 5×5 matrix is used more often than a 3×3. Score likelihood and impact from 1 to 5 each and multiply them to get 1 to 25. A typical rule draws the lines like this: 15 or above goes to executive reporting, 8 to 12 is managed by the department head, and anything below is only recorded in the register. Here you need to record inherent risk and residual risk separately. Only with one score for when no action is taken and another for what remains after the response is applied can you verify whether the countermeasure worked. Score each risk twice, before and after the response.
Choosing a response also depends on conditions. Items with low likelihood but fatal impact (a factory fire, losing key staff) call for transfer and contingency plans rather than reduction, while items with high likelihood but small impact (fluctuating material prices) are cheaper to accept with a contingency reserve. But transfer only moves the financial loss. Insurance can pay for damages, yet lost customers and a damaged reputation do not come back, and even after a contract hands the risk to a vendor, final accountability stays with the buyer.
The most common failure in the field is scores clustering at 'medium.' Rating something 'high' means being handed the homework of producing a countermeasure, and rating it 'low' means taking the blame if it blows up later, so owners pick the middle. Then 30 items pile up in the center of a 25-cell matrix and priorities disappear. You need to separate assessors from response owners, or use a forced distribution that caps each department at three 'high' ratings. Another failure is a register that no one touches after the day it is created. A risk meeting held once a quarter is document storage, not monitoring.
John KimInstructor John Kim, author of “B2B Marketing Design” and CEO of Nanum Consulting
Jinho DanAccounting instructor who makes financial statements, costing, and tax easy to understandThis probability-impact assessment technique grew out of defense, aviation, and plant safety engineering, spread to project management and enterprise risk management (ERM), and was codified as international guidance in ISO 31000.
Consider a hypothetical case. Company A, an auto parts maker with 260 employees and annual revenue of about KRW 80 (≈ US$1) billion, launched a project to take parts for a new client to mass production within 8 months. In a similar project the year before, tooling delivery slipped 6 weeks and cost KRW 120 million (≈ US$89,800) in late-delivery penalties, so management gave one instruction: "Let's not trip up in the same place again."
- In week 2 after kickoff, the PM asked the five team leads to "write down only what has actually gone wrong in the past three years, not imagined risks." They collected 34 items and, after removing duplicates, narrowed them to 21.
- The production, purchasing, and quality managers each scored the risks from 1 to 5 without seeing one another's scores, and only the 6 items with scores 2 or more points apart went onto the meeting agenda. On tooling delivery, the purchasing manager gave a 5 and the production manager a 2.
- The tooling delivery delay, at a score of 20, was handled by placing parallel orders with a secondary vendor (reduction). The exchange rate fluctuation, at 15, was covered by a forward exchange contract (transfer). The 11 items scoring 8 or below were grouped under acceptance, with a KRW 40 million (≈ US$29,900) contingency reserve.
- For each risk, the register names the responsible team lead, sets a due date, and records the residual score after the response. The first 10 minutes of the weekly production meeting became a fixed 'red cells only' slot.
- In month 5, when a secondary vendor's equipment went down, the quality manager said, "Item #7 in the register just came alive," and drew on the reserve stock. The line was restored in 11 days with no stoppage.
- The result was 0 days of delivery delay and KRW 0 (≈ US$1) in penalties. Seven risks actually occurred over the eight months, all of them already in the register, and only KRW 18 million (≈ US$13,500) of the KRW 40 million (≈ US$29,900) reserve was used.