Risk Matrix Modelling Fault
Enterprise Risk Management (ERM) is describing a Risk Matrix[1] as: tool for ranking and displaying risks by defining ranges for consequence and likelihood. This is actually a very easy concept, if one knows how to develop matrixes, and this is where the catch is.
Over the 41 years, where I have been dealing with strategic, tactical and operational risk, on various levels, from political risk, criminal risk, communique engagement risk, project risk, etc., Matrixes was the centre point of all our measurement of the risk and to be able to explain the risk level to our peers or the Board of Directors.
In most of these cases, the Risk Matrix has been the most reliable methodology we could derive upon, where we have a shared vision and a shared measurement structure.
With the changing of environments, I have experienced various types of risk matrixes, from a 3X3, 4X4, 5X5, 7X7 and even a 10X10 matrix. And everyone of these has a place and time for its use. In the case of a 10X10, within a chemical, engineering or production environment, the preciseness of the data gathered made the ranges between the various levels definable and understandable. Each Likelihood[2] and Consequence[3] could be explained in detail and within precise measurable parameters. The more and better the data has been obtained and collected, the better the decision or the better the movement of the parameters within the process flow. This made the decision-making process easy and fully understandable for everyone and every stakeholder.
The Common Universal Risk Matrix
The universally used Risk Matrix within an immature Risk Management Environment, is the 5X5 Model (see diagram). The more commonly methodology behind the use of the 5X5 model is that one multiplies the Likelihood and the Consequence factors, and you will obtain a Level of Risk (LoR)[1]. The LoR represents the magnitude of a risk or combination of risks, expressed in terms of the combination of consequences and their likelihood. This sounds valid and the Risk Matrix indicated in the above diagram, looks and expresses the requirements of a valid Risk Matrix. It has a 1 to 5 level of Likelihood, a 1 to 5 level of Consequence and its cross reference with the figures within the risk matrix, when multiplied, to reach a LoR.
But, is this a valid and acceptable measurement within the modern world of Enterprise Risk Management? And if not, what is the alternative.
Test the Validity of the Risk Matrix
As stated in my Introduction, I have been working and exposed to extreme matrixes, from Intelligence based matrixes, measuring the validity of the source or agent, the validity and accurateness of the information and has it be concurred by another source (low level agent), or a fully fletched agent (extremely accurate) in the structure and the specific environment. And then we are only getting to the information of intelligence gathered. This is measured against various matrixes, because if there is Intelligence gathered, which is not verifiable and there are mitigations implemented on incorrect Intelligence, which turns out to only be uncorroborated information, and lives are lost, then the validity of the actionable risk based information, are in doubt and will never be believed again.
Thus, with the example stated above, and this is a real example of a real-life situation, one is always asking yourself, what is the validity and accurateness of the Risk Matrix, and how was the Risk Criteria[2] for each of the Likelihood and Consequence Levels defined. An extremely important process within the design of the Risk Matrix.
The Risk Matrix diagram above needs to be validated. With the validation process, one needs to be asking what the objective of the Risk Matrix is. Well, any risk matrix is designed to determine the Level of Risk (LoR), and the significance of the LoR. Is it Low, Medium, High or Catastrophic?
Risk Matrix Accuracy Modelling
The Risk Matrix validation process was developed to determine on which level are decisions made and what is the correctness of the decisions, purely looking at the Risk Matrix Modelling. The above model's analysis looks like the diagram below.
The process involved the listing of every number within between 1 and 25 and then to verify the number with a visual representation within the Risk Matrix Model. The result was astounding. The general accuracy of the 5X5 model, based on multiplying the Likelihood and the Consequences, are in general 56% correct. This is indicating that the Risk Matrix Model has a 44% Fault factor. How can this be acceptable to any enterprise of company, whose daily work is based on managing Risk[1].
The analysis provides four columns of analysis. The
- first is the general model analysis (56% correctness),
- the second, the measurement between 1 to 10 (90% correctness),
- the third level, 11 to 19 (33% correctness) and
- between 20 to 25, a staggering 17% correctness.
This means that on Operational level, there is an accuracy of 90% of the Risk Matrix Model. In effect, what Top Management or the Board has decided here, is that a 10% fault figure is acceptable, as it is built into the model.
On Tactical Level, where bigger decisions need to be made, affecting the Operational Environment, has an accuracy level of 33%. The same as with the Operational Levels, The Top Management, Audit and Risk Committee (ARC) and the Board, are implying that there is provision, or appetite[1] for 67% fault figure with the Risk Matrix Model. This is in itself absurd.
And lastly, the Board and Exco. Yes, this structure is working within the range of making risk-based decisions on this Risk Matrix, between the risk level 20 to 25. Well, this Risk Matrix Model provides accuracy of only 17%. This implies that the Board and Exco makes for themselves provision for 83% fault figure.
Can this be true and how many companies are still using this immature Risk Matrix Model?
Well, I can assure you, that with the CAA exposure over this many year and across the various continents, the Immature Model is the Best Practice. If you even Google Risk Matrix, you will find this model as the model under the images. The question is, how wrong can you be before you are looking into the detail? This Risk Matrix Model creates the opportunity for bad decisions, wrong assessments of risks, emerging risks and risks on the horizon. This also opens the business or enterprise to corruption and mismanagement, as risk is not seen as a science, but the best guestimate you can have.
The New Risk Matrix Model
Yes, I am turning the applecart upside down and state it boldly, risk management Risk Matrix Models, as it is proposed by many institutes, government guidelines and others, are Modelling faults. Business modelling has been identified as one of the Top 10 Risks during 2017 to 2019 by Risk.net.
The mature Risk Matrix Model is described in the risk matrix above is a mature model. This Risk Matrix Model is used in some of the oldest and most critical and mature companies globally. Where the wrong Level of Risk (LoR) has grave and institutional effects on the company, employees, stakeholders, communities and lastly, shareholders.
This model has also been validated in the same way as the previous immature Risk Matrix Model, and every number between 1 and 25 can be accounted for. Thus, there are no gaps, no scenario missed or left out and no hiding from addressing risks.
Let's put the Theory to the test: Practical Example
I have provided a lot of information and usually, when this discussion is presented and finalised in front of Boards, Executive Committees, Chief Risk Officers (CRO), they are asking, so how does this work in my business. Well, the proof is in the example below. The objective of the example is twofold,
- first; does the Mature Risk Matrix Work with accuracy and
- secondly, how does this help to have a better understanding of the risk and how do I prioritise the various risks.
The above modelling test proofs that the Mature Risk Matrix has another layer of weighting build into the model. The Consequences are higher rated than the Likelihood, as the consequences has a diverse application, from people safety, financial, operational, strategic, legal, reputational. And we can continue repeating the same process. It will always be the same.
You will also see that the Risk Ranking of the Immature Risk Matrix is consistently the same, whereas the Risk Ranking with the Mature Risk Matrix is different. This makes it easy to Rank the various risks as well as to prioritise the various risks.
This model is not only used in Risk Management, but in Business Continuity, Health and Safety, Compliance and all other Risk Based Models and Management Systems. This is the new standard of measuring risk.
Crest Advisory Africa (Pty) Ltd are experts in the Global Corporate Governance field. We are here to change with the times and set the tone going forward, during all the challenges of the Global economy.
CAA has also developed a GRC-A software, where this matrix and other advanced matrixes, for better decision making has been integrated. We drive Performance and Certainty and provide global changing methodologies within the Corporate Governance universe.
COVID-19 has created a demand to measure better and to equate our decisions based on science. This must translate to the general workplace, whether you are an airline carrier, a train system, of a bank. With the wrong's models, you will make awful decisions. With the relevant, acceptable, suitable, effective and efficient models, CAA can assist enterprises to drive their risks and their objectives to the new standard.
[1] ISO 73:2009: Risk Management Vocabulary and Terminology: Par. 3.6.1.7
[2] ISO 73: 2009: Risk Management Vocabulary and Terminology: Par.3.6.1.1
[3] ISO 73: 2009: Risk Management Vocabulary and Terminology: Par.3.6.1.3
[4] ISO 73: 2009: Risk Management Vocabulary and Terminology: Par.3.6.1.8
[5] ISO 73: 2009: Risk Management Vocabulary and Terminology: Par.3.3.1.3
[6] ISO 73: 2009: Risk Management Vocabulary and Terminology: Par.1.1
[7] ISO 73: 2009: Risk Management Vocabulary and Terminology: Par.3.7.1.2