The risk matrix is a much used and misused tool.

What is the matrix for?

A risk matrix allows you to assess the probability and severity of an unexpected event with a view to identifying the effort that needs to go into avoiding that event. The event can be an accident, a change in the law, a change in market conditions or anything that would have significant impact on the business.

One of the great values of a matrix is its ability to capture the knowledge of organisations professionals and to use the matrix to engage the organisations top management.

There is a balance between ease of use and simplicity and the desire to back the matrix with probabilities. My personal view is that once the matrix gets too detailed you run the risk of disengaging people as well as creating spurious accuracy-trying to ‘micrometer a brick’

While the risk matrix (which can even be an opportunity matrix!!) can cover many different risks I am going to focus on the risk of an accident.

Figure 1 Unmitigated Risk

The figure above is a generic risk matrix. The matrix can take many forms 2X2 3X3 etc. I have not put any scale on for reasons which will become clear.

The first question is does the risk related to the unmitigated risk or the ‘residual’ risk after mitigations have been applied. In figure 1 it’s the unmitigated risk. Imagine you have just set up a business and have no mitigating processes in place. The matrix will inform how you set up business and what protective processes you need.

Visible Catastrophic Incidents really describe the things that happen so often they are ‘in your face’. If you don’t deal with them you go out of business. Its Darwinian survival of the fittest, or an intelligence test. If you can’t manage those risks you should not be in business. I am sure we can all recall companies that went out of business because they could not control these risks. Or industries that evolved to deal with them. The tanker industry over the last thirty years is one example, or the airline industry since the 1930’s.

Personal Injuries are generally lower severity but higher probability. Once more they are obvious because of their regularity and barriers are put in place to deal with them. They are easily tracked and monitored. There is a historical tendency to focus on this monitoring to the detriment of the less common incidents. For many years a low frequency rate was seen as indicative of overall safety including in operational/process safety.

Invisible Catastrophic Incidents tend to be ‘company killers’. The probability is seen as low but the severity is so huge that if it does happen the company may struggle to survive. The recent Gulf of Mexico spill and its impact on BP is one example as is the effect of the Lockerbie bombing on Pan Am. Emergency response capability is often relied upon to deal with these types of incidents.

By definition the higher probability incidents have more information available to mitigate and more senior management focus to ensure funding is available. The fundamentals of business are that return on a business is reward for taking risk. So no business can mitigate all risk without sacrificing its return. (Massive simplification) Another way of putting it is that it takes a lot of effort to justify expenditure on mitigating something that is highly unlikely.

What about the residual risk after mitigation. To reduce a risk barriers are put in place. These may be engineering based, process based or related to training. In process safety these are the plant, process and people barriers. Barriers will be covered in more detail elsewhere.

The figure below shows the effect of mitigation. The green shapes are the residual risk after mitigating barriers are put in place.

In our industry the use of the SMS required by ISM captures knowledge and learning from accidents and from wider industry.

In the early days of ISM there were many easy wins. An easy win in risk management is a barrier that:-

1. Is effective in mitigating the specific risk it was designed to mitigate.

2. Can act as a barrier to a wider range of risks.

3. Is efficient in terms of the effort required to put the barrier in place and maintain it at peak efficiency.

4. Its importance is obvious to the operators

5. Sets alarm bells ringing when the barrier is removed

6. Fits comfortably with the organisations existing process, training and ways of doing things and does not create excessive complexity.

More about barriers in a separate article.

Figure 2 Residual Risk

The figure presents an idealised view of the world. Over a period of time with the help of the Safety Management System risk is reduced as new learning leads to new barriers and reduced risk.

In terms of personal accidents much information is available to reduce risk and over a period time you should be able to reduce the risks to those which are in the hands of the individual such as slips, falls, manual handling, eye damage.

In terms of the visible catastrophic accidents the will generally fit into the operational or process safety category. Improved barriers will in many cases be mandated, learned from wider industry incidents and industry bodies who share these learning’s. New barriers may be developed by Hazops etc in a more sophisticated operation.

In the extreme the low probability / high severity incident will attract minimum attention other than to ensure emergency response systems are in place to mitigate the effects of the catastrophe.

So why do catastrophes still happen?

1. Bad luck. A low probability is still a probability that an incident will occur and it may be that an incidents time has come.

2. It may be that the probability of a catastrophe has been underestimated and a high probability catastrophic incident has been hidden.

3. It may be that the barriers were not as strong as were originally thought

4. The barriers may have been inadvertently removed in the drive to reduce costs or for other reasons. It may be that what was thought to be multiple barriers were in fact inadvertently linked such that single failure disabled all the barriers. This gets into the world of small world networks and complexity which will be covered elsewhere

5. Increased complexity of an organisation can create its own risk by submerging what is really important or by inadvertently disabling a barrier.

6. Workload. The law of diminishing returns means that the quick wins fall away and more and more effort and process is needed to mitigate. Other demands and priorities intrude and over time barriers are not maintained or disregarded. The risk associated with workload is a major issue and also will be discussed elsewhere

So where does this put us.

Risk assessment if properly carried out is essential to manage a business safely. If done perfectly you can reduce risk substantially. If done badly you can create work and not reduce risk. Dealing with these issues needs skill and commitment.