Knowing how to score a risk is a key part of the risk management process. Defining and evaluating risks tells you what risks you have. Risk scoring helps you prioritise risks for action based on your appetite for, and tolerance of risk. in this article we will explore how to score risks using a five by five matrix that looks at likelihood and consequence.
Contents
________________________________________________________________________________________________
________________________________________________________________________________________________
Defining Your Risks
A risk is something that can happen, not something that has happened. Therefore, when it comes to scoring risks, you are making an estimate.
Before you can make an estimate of your risk score you need to think about the risks you may be facing, and describe them in ways that allow them to be scored.
Before you go further you might find it helpful to read:
-
an introduction to risk management here.
-
ways of identifying risks: using a SWOT analysis or a PESTLE analysis.
How to Score a Risk: Unraveling the Five by Five Matrix
There is no “one right way” to score risks, so long as it is done consistently. Scoring risks allows you to compare them, and prioritise them for action.
The method that we use and introduce people to in our risk management training courses is the five by five matrix.
That means you score the two key elements of a risk: the likelihood of a risk occurring and the consequences or impact if it did out of five.
-
the scale for likelihood goes from 1, very unlikely, to 5, virtually certain
-
the scale for impact goes from 1, no material impact, to 5, catastrophic
This gives you two numbers to multiply together giving you a range of scores, from 1 (1×1) to 25 (5×5).
The Advantage of a Five by Five Matrix
The main advantage of this approach is it highlights the highest scoring risks. Look at the range of score you can get from this approach:
1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 20, 25
There are big gaps between the scores at the very top of the range, making your “biggest” risks really stand out.
The five by five matrix stands as a powerful tool, providing a structured approach to measure the likelihood and consequence of potential risks.
Navigating Likelihood
As discussed above on the Likelihood axis, a score of 1 suggests an event with the lowest probability, almost bordering on implausible. In contrast, a score of 5 indicates an event that is highly likely, almost imminent.
A score of 1 does not mean impossible, and a score of 5 does not mean inevitable or certain to happen. Your range of 1 to 5 measures probability not certainty.
You can help determine likelihood in a number of ways. Considerations include historical data, external factors, and expert opinions.
For example, if you wanted to work out the odds of the central bank increasing or decreasing interest rates you might consider
-
the history of interest rate changes
-
whether inflation is going up or down
-
recent economic performance
Risk probability can change over time. If you have a time limited project the chance of a cost or time overrun may increase or decrease as you approach the project end date. Weather related probabilities may change with the seasons. Probabilities are not static.
Likelihood can also be measured objectively if you consider the failure rate of manufactured products. This is especially true if manufacturers use techniques like six sigma to improve quality and efficiency.
________________________________________________________________________________________________
Sign Up Here:
________________________________________________________________________________________________
Understanding Risk Impact
Impact is the effect of the risk if it happens. Again this will range from very minor, to catastrophic.
There are three main types of risk: financial, operational, and reputational. You can find out more about different types of risk here. For the purposes of this article about how to score a risk, let’s look at impact for these different types of risk
Financial Risks
Financial impact could range from minor – a cost overrun for a project that is a very small percentage of turnover – to the company going bankrupt. Intermediate steps might include reallocating resources, making cutbacks including redundancies, or an inability to make planned investments for business growth.
Operational Risks
The impact of operational risks can again go from very minor – small traffic delays holding up delivery – to catastrophic, where disruption may require activating disaster recovery or business continuity plans.
Reputational Risks
Reputational risks can arise from bad publicity, customer complaints, or unethical behaviour. The range of consequences for reputational risks can go from minor expressions of dissatisfaction on twitter that need a PR response, to major coverage in global media and/or questions being asked in Parliament.
Impact in Context
Unlike probability risk impact is context dependent. A cost overrun on a project could have a major impact on that project, but will not have the same impact on the organisation as a whole. Therefore when making a risk assessment you need to consider the level at which the risk is going to be reported.
Mapping Your Risks
Once you have identified your risk probability and risk impact you can score your risks and map them out. By mapping them across your five by five matrix you can get an at a glance view of your risks and where they are concentrated. If you colour code your risks by business area or risk type you can also see what areas are posing the most or the greatest risks.
For example, using the image below, if blue were financial, purple were operational and black were reputation you could see your greatest risks tends to be financial.
Similarly, if blue were IT, purple were HR and black were sales, you could see your greatest risks were IT related.
Challenges in Risk Scoring
There are a number of challenges to scoring risks. When thinking about how to score a risk the following factors need to be considered.
Subjectivity in Scoring
Scoring involves a degree of subjectivity, influenced by individual perspectives and biases. Establishing clear scoring criteria helps mitigate this challenge.
Likelihood and Consequence Changing
Risks evolve, and so should their scores. Regular reviews and updates are essential to capture changes in the risk landscape.
Limited Data
Inaccurate or incomplete data can hinder precise scoring. Organisations must invest in robust data collection mechanisms. There is not much point in knowing how to score a risk if you do not have the information you need to do it.
Not Learning from Experience
Each risk event offers lessons. Organisations should use post-event analyses to refine their scoring criteria and enhance the accuracy of future assessments.
Business Needs Changing
In a dynamic business environment, the risk landscape evolves. Organisations must adapt their scoring methods to stay ahead of emerging threats.
________________________________________________________________________________________________
Gain the practical skills you need to identify and manage risk with this five-star rated training course.
Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.
________________________________________________________________________________________________