Risk Assessment Matrix

Origin. MIL-STD-882; ubiquitous in enterprise risk management.

Mechanism. Plots likelihood against consequence on ordinal scales and colours the cells. It is a communication device.

Procedure. Categorize likelihood and consequence. Locate the cell. Apply the response the colour prescribes.

Applies to. Communicating a risk register to people who will not read a distribution.

Limitations. Documented and severe. Cox (2008) proves that risk matrices can assign higher ratings to quantitatively smaller risks, that they cannot correctly reproduce a risk ranking with more than a few categories, and that ordinal inputs cannot be multiplied. Range compression makes the categorization arbitrary at the boundaries. It should not be used to rank, only to display.