The Fundamental Flaw of the Risk Matrix Tool

Risk matrices are commonly used tools in risk management, intended to visually represent the level of risk by categorising potential events based on their likelihood and consequence. While this tool is widespread across industries, from workplace health and safety to project management, it is not without its flaws. One significant flaw that often goes unnoticed is how risk matrices inherently "accept" high-consequence, low-likelihood risks.

The Problem with High-Consequence, Low-Likelihood Risks

Risk matrices commonly use a colour-coded approach to illustrate varying levels of risk, from low (green) to high (red). However, when examining these matrices, a pattern emerges: even when the potential consequences of an event are classified as "Major" or "Catastrophic" — involving single or multiple fatalities or show-stopping financial losses — these risks are often calculated as "Low" or "Medium" overall.

This discrepancy arises because the risk matrix combines two factors: consequence and likelihood. If the likelihood is considered low enough, even severe consequences can be categorised as "acceptable." But is this truly acceptable?

In the examples below, very high-consequence, low-likelihood risks are rated very low (click to expand). A quick search of Google will show you that this is a VERY consistent risk matrix.

The Fundamental Flaw of the Risk Matrix Tool

Before you continue reading: please have a look at your company risk matrix and see if yours looks like the examples above.

Why Likelihood Ratings Are Fundamentally Flawed

Likelihood ratings are almost always subjective and based on opinion rather than objective, evidence-based assessments. Very rarely are controls assessed for their effectiveness to determine an actual likelihood score. The assumptions made about likelihood often reflect a theoretical understanding rather than practical reality.

Organisations use a static, qualitative assessment process to estimate likelihood, which is inherently flawed. Without robust assessment of control effectiveness, a risk may be wrongly calculated out of the risk register entirely. For instance, if a catastrophic event is deemed "Unlikely" based solely on intuition or limited historical data, it may fall off the register, receiving minimal oversight or governance.

The Impact of Poor Control Effectiveness Assessments

Likelihood should not be calculated independently from control effectiveness. Controls are meant to prevent or mitigate an unwanted event. If the controls are ineffective, the likelihood of occurrence increases.

Control effectiveness should be evaluated using the hierarchy of control. For example:

Elimination is the most effective control type, aiming to completely remove the hazard.
Substitution, Engineering Controls, and Isolation provide layers of protection but can still fail.
Administrative Controls and PPE are the least effective as they rely on human behaviour and adherence to protocols.

If an organisation relies on administrative controls or personal protective equipment (PPE), the likelihood of the event occurring should be rated much higher. Failure to properly assess control effectiveness results in flawed likelihood ratings and, consequently, flawed risk assessments.

Risks Calculated Out of the Risk Register

When a risk is categorised as low or medium due to an inaccurate likelihood assessment, it often receives no further scrutiny. This is particularly dangerous when the consequence of the risk is catastrophic. Without a process of assurance or governance to challenge the risk assessment, the organisation effectively accepts an unacceptable level of risk.

Furthermore, there is often no requirement for further risk assessment, formal approvals, or a process to improve the controls to reduce the risk. Once a risk falls off the register, it typically ceases to receive attention, leaving the organisation exposed to potentially devastating consequences.

The Solution: Improving Risk Assessment Processes

A more effective approach involves shifting from a static matrix-based assessment to a dynamic process that continuously evaluates control effectiveness. Rather than relying on subjective estimates of likelihood, organisations should assess the robustness of controls and adjust likelihood ratings accordingly.

By building control effectiveness into the likelihood calculation, organisations can:

Ensure high-consequence risks are never calculated out of the register without proper oversight.
Implement formal assurance processes to validate control effectiveness.
Challenge and continuously improve controls to reduce the risk.

Redesigning the risk matrix to match your organisation's risk appetite is another option, ensuring that all catastrophic risks are rated high. See example below.

In this example, there are no extreme or moderate consequences that are rated low or medium (green or yellow), so regardless of the likelihood, these risks would receive attention and would remain on the risk register.

Conclusion

The fundamental flaw of the risk matrix tool lies in its failure to properly assess control effectiveness when calculating likelihood. When high-consequence, low-likelihood events are calculated out of the risk register, organisations remain vulnerable to catastrophic incidents.

It is essential to acknowledge the limitations of risk matrices and adopt a more robust, evidence-based approach to assessing likelihood. Incorporating control effectiveness assessments into the risk management process is a critical step toward improving safety outcomes and preventing catastrophic events.

Please contact us if your risk matrix needs to be redesigned or your control effectiveness needs to be incorporated into your current risk assessment process.

Critical Risk Management

Critical Control Management