Creating a Risk Matrix: Impact and Likelihood Assessment Guide

The risk register must be dynamic because risks change. Management should ask about: biggest clinical risk this month, which unit is most vulnerable to which risks, which mitigation is late, and what decisions are needed. Leaders must get directly involved to catch risks and ensure follow-up on findings.

A Risk Register must include: (1) Risk identification and description, (2) Likelihood assessment, (3) Impact assessment, (4) Risk priority rating, (5) Color coding for risk levels (red for high, yellow for moderate, green for low), (6) Responsible person for each risk, (7) Mitigation actions, and (8) Timeline for implementation. The register should be reviewed regularly to assess whether mitigation actions have reduced risk levels. Risk registers should distinguish between identifying risks versus documenting events, focusing on systemic issues rather than individual incidents.

A risk register is a comprehensive document containing identified risks with unique codes, descriptions, owners, sources, impacts, probability scores, impact scores, combined risk scores, current controls, required additional controls, action plans, and monitoring requirements. The register serves as the central repository for all risk information and creates heat maps showing risk distribution. Risk treatment planning involves developing specific actions: identifying gaps between existing controls and required standards, designing alternative controls when existing ones prove inadequate, creating detailed action plans with responsible parties and timelines, and establishing monitoring mechanisms. Ongoing monitoring ensures planned actions are implemented and risks remain within acceptable bounds, tracking progress against action plans, verifying new controls are properly implemented, recording actual risk occurrences, and updating assessments as circumstances change.

A risk register is a dynamic decision-making tool for identifying, documenting, assessing, prioritizing, and monitoring organizational risks, which must be properly designed and maintained to provide visibility into emerging risks and support accountability; regulatory compliance extends far beyond mere formality of ticking boxes, requiring thorough documentation to prove that appropriate measures have been implemented to meet legal and industry requirements.

The risk register is a dynamic document that requires ongoing updates. When there are changes in the probability or impact of any identified risk, these changes must be documented in the risk register. This ensures that the project team always has current information about the risk landscape and can adjust their response strategies accordingly.

ISO 31000 is a non-certifiable international standard providing principles, guidelines, and practical recommendations for effective risk management. The framework follows an iterative cycle including context establishment, risk identification, analysis, evaluation, treatment, monitoring, review, and communication. A risk matrix is a visual tool for managing risks by graphically presenting relationships between processes, risks, causes, and response strategies. Key concepts include: risk as uncertainty about organizational objectives (encompassing both threats and opportunities), causes as sources of risk materialization, consequences as outcomes, impact as magnitude of loss/gain, frequency as occurrence likelihood, inherent risk as pre-control assessment, controls as mitigation strategies, and residual risk as post-control acceptance level. Risk matrices enable prioritization, cost-effective resource allocation, stakeholder communication, decision-making support, and continuous improvement through visualization.

ISO 31000 provides universal, non-certifiable guidelines for risk identification, analysis, evaluation, and treatment applicable to any organizational context, while COSO ERM offers a more specialized framework focused on integrity, fraud, and corporate governance risks, particularly valued in financial sectors; both frameworks complement each other and share similar underlying logic, with ISO 31000 being part of a broader family of risk management standards including ISO 31073 (vocabulary) and ISO 31100 (tools), whereas COSO ERM introduces concepts like lines of defense for risk treatment.

Alex Sidorenko from RISK-ACADEMY compares ISO 31000 and COSO ERM as standards for risk management in non-financial companies. He states that both documents should be reviewed by risk practitioners to identify potentially useful elements, but neither contains fundamentally new concepts. According to him, the ideas in both standards have been discussed and implemented in the risk management profession for years. He suggests their primary value lies in their use as marketing tools to promote risk management to executives and decision-makers. Sidorenko notes that some countries have already achieved far greater maturity in risk management practices than what these standards reflect. He directs viewers to a 2017 webinar comparing the ISO 31000 draft and COSO ERM 2017, and references additional content on risk matrices and risk governance. He also promotes his free risk management book, Udemy courses, and advanced risk governance training, implying these resources offer more practical insight than the standards themselves. The tone suggests skepticism toward treating these standards as innovative frameworks, emphasizing instead their role as communication aids rather than substantive methodological breakthroughs.

Organizations must distinguish between systematic risks (diversifiable through organizational actions) and non-systematic risks (non-diversifiable). The framework requires balancing these risks to determine action paths. Key principles include creating value through risk measurement, integrating into processes, maintaining transparency, and ensuring dynamic adaptation. Organizations must establish risk acceptability levels through a matrix categorizing risks into unacceptable (immediate action regardless of cost), reasonably acceptable (action with low impact), and acceptable (monitorable). Risk measurement must be applied across financial, learning/growth, process, and stakeholder perspectives. The SLN (Sistemático, Laboral, No Sistemático) matrix separates labor risks from others for better integration. Organizations can integrate risk matrices based on their certification systems (ISO 9001+14000, 22000, 27000).

The Enterprise Risk Matrix is essential for identifying, prioritizing, and managing business risks. Organizations must evaluate controls based on popularity and effectiveness before implementation, conducting cost-benefit analyses. The matrix enables measurement of risk tolerance and appetite as percentages or monetary values, and calculates expected and adjusted losses. Two primary frameworks guide risk management: COSO 2017 with its five components and twenty principles, and ISO 31000 with its cyclical risk management process. Modern frameworks integrate organizational awareness, resilience, risk identification, analysis, mitigation, emergency response, business continuity, training, and documentation for traceability.

Quantitative risk analysis is optional and involves measurement rather than ranking. Techniques include: (1) Monte Carlo simulation - models combined effects of uncertainty to evaluate potential impact on objectives, (2) Expected monetary value (EMV) - probability multiplied by impact, (3) Sensitivity analysis - determines which risks have the most potential impact by correlating variations in project outcomes with variations in risk elements, (4) Decision trees - diagramming technique for evaluating implications of multiple options under uncertainty, (5) Influence diagrams - graphical representation showing causal influences and relationships among variables and outcomes.

This comprehensive section establishes the complete workflow for quantitative project risk analysis using Primavera Risk Analysis. It begins with importing a Microsoft Project performance measurement baseline, ensuring the finished date is in the future as risk pertains to uncertain future events. The process involves customizing import settings for time units, resource calendars, and enabling post-distribution creation. Next, uncertainty modeling is established through three-point estimates (minimum, most likely, maximum) for each activity duration, with practitioners choosing between triangular distribution (simple averaging) and beta distribution (weighted averaging favoring most likely values). The Quick Risk feature automates estimate population based on percentages of most likely durations. Running risk analysis performs Monte Carlo simulations with thousands of iterations, randomly selecting durations from probability distributions and dynamically adjusting the critical path. Results are interpreted through distribution graphs showing frequency bars and probability percentages on the right-axis. For example, a project estimated to finish on March 31st might actually have only a 2% probability of meeting that date. This probabilistic approach enables realistic sponsor negotiations by replacing deterministic assumptions with statistical reality.

Risk analysis involves two complementary approaches. Qualitative analysis classifies risks based on probability and impact (high, medium, low) using matrices to prioritize which risks require immediate action. Quantitative analysis provides numerical measurements, including Monte Carlo simulation (using computer software to generate thousands of scenarios based on probability distributions) and Value at Risk (VAR) analysis (measuring maximum expected loss with a given confidence level). These techniques help organizations quantify potential losses and make informed decisions about risk controls and provisions.

Quantitative risk analysis assigns numerical values to risks and is reserved for high-probability or high-impact risks requiring significant attention. Two primary methods exist: Monte Carlo simulation, which runs mathematical models thousands of times to produce probability distributions based on assigned probability curves; and decision tree analysis, which breaks risks into scenarios with assigned costs and probabilities for each response option. These techniques provide exact dollar values or time equivalents for risk impacts, enabling expected value calculations that inform budgeting decisions.

Monte Carlo simulation is a probabilistic risk analysis technique that replaces single-point estimates with probability distributions to model uncertainty and variability in complex systems, enabling decision-makers to understand the full range of possible outcomes and their likelihoods rather than relying on deterministic point estimates; this approach allows businesses to make more informed, defensible decisions by quantifying risk exposure and identifying key drivers that impact outcomes.