Fundamentals of Risk Management

evaluation
Application of a risk matrix
The use of a risk matrix is a very simple way of demonstrating the level of risk that 
a particular event represents to an organization. A risk matrix is normally used to 
represent the residual or current level of risk. This can also be referred to as the net 
risk. When the risk matrix is used to illustrate the current level of risk, the vertical 
axis will normally be labelled as impact. However, the risk matrix can also be used 
to represent gross or inherent level of risk, which is the level of risk before controls 
are applied. When the risk matrix is used to illustrate the inherent level of risk, the 
vertical axis may sometimes be labelled magnitude.
The concept of consequences is a little different. Impact is used to represent the 
overall level of risk faced by the organization. This level of risk or impact will arise 
because of the potential consequences. Therefore, ‘consequences’ is used as a broader 
term that provides more detail and information on how successfully the risk is being 
managed. For example, a warehouse fire could represent a substantial loss that has
a high magnitude. If the organization is fully insured, the impact on the finances 
should be minimal. However, the consequences of the fire could be significant, if (for 
example) other stakeholders in the vicinity are affected and the reputation of the 
organization is damaged.
Table 11.4 sets out the range of issues that could be faced by an individual. Using 
this ‘issues grid’, individuals would be able to identify the priority significant risks 
that they face. These risks are illustrated in the risk matrix shown in Figure 12.1. 
Having placed the various risks on a risk matrix, the relative importance of the risks 
can easily be identified. An overall view can then be taken as to whether the risk 
profile (or risk exposure) is within acceptable limits and within the risk appetite and 
risk capacity of the individual.
Large organizations frequently make use of a risk matrix as a means of summariz-
ing their risk profile. The risk matrix is very useful and can be used for a range of