However, this is what appears to have been done in the CAA UK’s CAP 795, Safety Management Systems (SMS) guidance for organizations (Table 1). Similarly, 70 degrees is not twice as hot as 35 degrees, because multiplication cannot be applied to an ordinal scale. Using the previous example, we cannot say that “excruciating” is twice as painful as “some”.

The numbers are irrelevant as long as the order stays the same. Ordinal responses may be transformed in any way that preserves their order, which in a 5×5 risk matrix could be 1-5 or even 0,5,37,40 and 103. What’s excruciating to me maybe merely “a little painful” to you. This also emphasizes the subjective nature of the scale. The responses go from least to most pain, but it’s not clear whether the difference between “none” and “a little” is bigger, smaller, or the same as the difference between “a lot” and “excruciating”. Questions with subjective responses are often ordinal, for example, “how much pain are you in?” could be answered with “none”, “a little”, “some”, “a lot”, “excruciating”. An ordinal scale has no fixed distance between the levels the numbers represent a rank position. From the numerous and varied scales I have encountered in aviation and elsewhere, the common factor is they are typically ordinal scales. My research highlighted that there is no scientific method for designing the scale used in a risk matrix. I was delighted to find my skepticism was well placed! I have always been mildly skeptical of risk matrices, struggling to see how all that risk data can be condensed and simplified into a single box, and still remain meaningful. A risk matrix is meant to help categorize, prioritize and compare risk, so what difference do 5 or 4 rows or columns really make? I assumed it would depend on how precisely the severity and likelihood ranges had been defined but what I found out was so much more. The guidelines for scales, scores and status should be set out in the assessment section of the risk management plan.I was asked the other day what advantage a 5×5 risk matrix has over a 4×5 and it started me thinking. This can be presented in a RAG format with associated guidelines as to how each event should be managed according to its red, amber or green status. If all the possible combinations of ranking value are calculated for both threats and opportunities the table below is formed. The effect of this is to put more emphasis on impact than on probability. This is because probability scores are defined on a linear scale while impact scores are on a logarithmic scale. Interestingly, a risk event that is low probability/high impact has a different score than high probability/low impact.

A risk event of high probability (0.7) and low impact (0.1) would have a ranking value of 0.7 x 0.1 (0.07).

A risk event of low probability (0.3) and high impact (0.4) would have a ranking value of 0.3 x 0.4 (0.12).

The probability and impact scores are used to arrive at overall values for ranking the risk events. These indicators will be defined according to the context of individual projects and programmes, and set out in the risk management plan.

A two month delay on a six month project is very different to a two month delay on a three year project.Īll the impact indicators in the table need to reflect the risk context of the work and in particular the risk appetite of the host organisation. Clearly, the guidelines for what constitutes high or low are not universal. It also provides impact criteria in the three elements of the triple constraint. This ‘risk criteria table’ provides numerical ranges for the probability scale from very low (VLO) to very high (VHI). The example below applied to threats and is adapted from the APM’s PRAM Guide 1. As the complexity of the work increases, the sophistication of the assessment should increase.Ī thorough assessment of risk events for projects of higher complexity and for programmes would have a five point scale with guidelines and numerical values for each point on the scale. Project, programme and portfolio managementĮvery risk event, whether it is a threat or an opportunity, has two characteristics: the probability that it might happen and the impact it would have if it did happen.Įven on the simplest of projects, risk events should be assessed for their probability and impact using a scale such as high, medium and low.

Risk probability number impact number