| WHAT IS A RISK MATRIX? A risk matrix is a table used to assign a 'score'
to the identified risk, to assist with the risk management process. In fact it
is the core of the risk management documentation. For each risk identified, a
score is assigned for the probability and impact aspects.
Often a range of 1 to 5 is used for each
aspect. Different organisations use different ratings, and you will
probably want to tailor something which suits your circumstance. A simple
example is given below.
RISK PROBABILITY
(The likelihood that this risk will actually happen)
- Almost certainly will not occur
- Very unlikely to happen
- Quite possible - it has happened on some
previous projects
- Probably will happen.
- Certainly will happen, no question.
RISK IMPACT
(The consequence if this risk / threat was to actually happen)
- Almost negligible impact - can easily be
rectified.
- Would have small effect on budget or schedule.
Could take a few days to fix.
- Noticeable effect on budget and schedule. Will
require review of plan & some rescheduling.
- Serious problem which could affect credibility
/ integrity of project. May need to seek additional resources / funding. May
need to consider significant project reschedule.
- Critical project failure. Could cause project
to fail or be abandoned. Likely to cause costs or time estimates to be more
than 70% behind.
RISK MATRIX
(Table showing overall rating of risk)
- Involve a broad range of stakeholders when
analysing risk
- List every risk identified.
- For each risk, estimate probability and
impact.
- Calculate overall rating (Probability X
Impact)
- Identify detailed risk mitigation (reduction)
strategies
- Optionally, estimate 'net' risk rating (after
allowing for effect of mitigation strategy)
EXAMPLE
(The following table is a simplified example for the purpose of explanation).
| RISK |
PROBABILITY |
IMPACT |
RATING |
MITIGATION |
NEW RATING |
| Developers do not have
experience in new technology being implemented |
4 |
4 |
16 |
Detailed
training schedule to be implemented for completion prior to development.
Seed team with experienced contractors. Team leader selection criteria to
include appropriate skills & experience. |
8 |
| Funds were allocated prior to
detailed design. May not be sufficient. |
2 |
3 |
6 |
Seek
15% contingency funding to allow for expanded scope.
Rate requirements from mandatory to 'wish list'. |
4 |
| Operational staff have a history
of not accepting new systems. If they are not ready, we could suffer huge
losses. |
3 |
4 |
12 |
Expand
'change Management' team, using experienced staff.
Develop staff communication strategy.
Develop detailed (operational) staff training schedule.
Develop 'champions' in operational areas. |
8 |
RISK 'MANAGEMENT'
The above is only useful if the mitigation
strategies are developed and implemented. Reviews are necessary to track
progress and effectiveness of the strategies and plans, to revise or develop new
strategies as required, and to determine if any new risks have arisen.
It is not usually possible to overcome every
risk. Concentrate on the risks with a high rating, particularly those considered
to have a high impact value.
Seriously question the feasibility of a project
with too many highly rated risks.
FAQ PAGE
NEXT QUESTION
RISK MANAGEMENT PAGE
|
Island
Consulting Pty Ltd
|
Risk
Management
Matrix
|
October 2000
|
|
