Risk data is complex, particularly for enterprises with multiple sites, or sprawling leadership structures. It can be difficult to know which threats need to be prioritized, which controls should be updated, and which playbooks need to be reviewed.

A risk matrix is a tool that can simplify this process; using a simple chart and risk assessment data, your team can put together a basic matrix that allows you to see at a glance which threats need immediate attention.

What is a risk matrix?

There is a basic equation for calculating risk:

Risk = Probability x Severity

In other words, risk is determined by how probable an event is and the severity of that event, should it happen.

A risk matrix — also called a risk management matrix or a risk assessment matrix —is a visual tool based on this formula. Organizations use risk matrices to assess and visualize their risks, and two prioritize threats based on how high their risk is.

Typically, a risk matrix consists of a grid that plots the probability of a risk occurring on one axis and the severity or impact of that risk on the other axis. The higher a threat ranks on both, the more priority is given to that threat.

This can yield some surprising results. Take the example of an active shooter, a situation many people — influenced by news coverage — think of as severe. However, a risk matrix can put this threat into perspective. While the impact of an active shooter on company grounds is severe, the likelihood of a shooter entering your site may be low. This means that the matrix might not give an active shooting incident a high risk score, instead ranking it as a medium risk.

On the other hand, employee theft may be a very likely scenario, and the impact of theft might be medium. This gives theft a higher risk score.

5 steps for building a risk matrix

Simple though a risk matrix looks, there are several steps that go into creating one, starting with data collection.

1. Identify your risk scenarios

A good risk matrix allows you to compare the risk of certain scenarios at each of your sites. For example, which location has the highest risk of an active shooter, theft, robbery, tornado, hurricane, flood, compliance and regulatory risk? Identify every reasonably foreseeable scenario so you can proactively plan for the situations with the highest risk scores.

1. Collect data

Before you can create a risk matrix, you need data about potential threats at each of your sites. To get this information, it’s important to properly analyze the risk at your sites. This means going beyond a simple security threat assessment (which measures inherent risk) and analyzing the effectiveness (security assessment) of your controls at each site. A risk analysis examines your residual risk — the risks that remain after your existing security controls were put into place. This sort of analysis gives you a true picture of the risk at each site, and allows you to compare the risk of each site.

1. Determine your risk score

As you create your matrix, you’ll be assigning probability and impact to each scenario.This doesn’t mean taking a cookie cutter approach to creating a risk score — every organization is different and that means that probability and severity — the two variables used to calculate risk — are also different for every enterprise.

1. Prioritize your risks and responses

Once your matrix is populated, you can begin to prioritize your response to each threat scenario. The matrix should be able to show you which scenarios are in need of a response immediately and which aren’t quite as pressing. Determine a response for each, and create a timeline for addressing all risks. The key here is to build a relative comparison of each location relative to a scenario. So in other words, which location has the highest risk of theft, active shooter, flood, not meeting compliance, etc.

1. Review continuously

A risk matrix isn’t a crockpot. You can’t just set it and forget it. It’s important to consistently monitor and measure risk, and continually update your plans as remediations are made to existing issues. Risk is dynamic and changes frequently so your residual risk at a location will change frequently as well. A risk matrix should be a living document that gives you the full picture of your enterprise’s risk at any point in time. This can be difficult if you’re building your risk matrix on paper, or using paper assessments.

How can risk management software build a risk matrix?

Traditionally, risk assessments have been done using paper reports, but technology is making the job easier, and automating several aspects of risk analysis — including the creation of the risk matrix.

For example, risk management software allows assessors to embed photos in their reports, capture points of risk with a click, auto generate reports, and create corrective action plans. Risk management platforms also use data from risk analyses to generate dashboards and risk matrices in real time.

Learn more about risk management tools and creating a custom risk matrix now. Talk to an expert today.

About the Author

Daniel Young

Founder & Chief Innovation Officer

Daniel has been a security and risk advisor for more than 10 years, and is passionate about helping companies to better understand their risks to undesirable events on a daily basis. Dan previously served as the Regional Bioterrorism Coordinator for District 1 in Michigan, where he was instrumental in preparing communities for catastrophic incidents. He has also acted as the Private Security Liaison for the City of Lansing’s Critical Infrastructure Team, which identified and documented deficiencies in the city’s critical infrastructure.

He is a Co-Founder of the CSO Risk Council, a think tank of seasoned security professionals and thought leaders with extensive experience in managing the physical security and risks of large enterprises consisting of multiple sites and whose mission is to create a better process to develop and share innovative solutions and pertinent information with organizations to improve safety and security risk by providing a forum to discuss best practices and recommendations for specific risk scenarios and to network with other enterprise security professionals.