Risk Management Matrix: Anticipating and Mitigating Risk
You can’t take the risk out of invention and no project is completely risk-free. But you can reduce the risk, even in the most innovative programs. How? By anticipating it. The Risk Management Matrix is an elegant way to anticipate, manage, and mitigate product development risks. The benefit of this methodology is that it defines a specific risk trigger point and defines it as a quantitative threshold. It also includes an action plan to mitigate the risk should you exceed the threshold.
Benefits of the Risk Management Matrix
- Helps identify risks before they occur
- Mitigates risks through early detection
- Generates quantitative metrics that help clarify when to act to mitigate a risk
- Accelerates action because the organization has clearly defined thresholds and an agreement to follow the process
The risks you anticipate are in the first column and act as headers for each row. The column headings consist of risk attributes such as likelihood, consequence, and a metric to track each risk. The likelihood and consequence are rated on a scale of one-to-ten, with a one meaning that the risk is nearly impossible with zero impact on the project. The remaining headings are the risk threshold, the date by which the threshold should be assessed, and then a short phrase that outlines an action plan.
The matrix is created in a cross-functional workshop. The project manager usually leads the session and plans ahead by creating the bones of the matrix, listing some of the likely risks and filling out the rest of the attributes and risk management factors. The project manager can often derive those risks from the list of boundary review conditions. The creation of this matrix should take place during the first ten to fifteen percent of a project’s duration.
After creating the tool, quickly review it at the weekly team meetings. The goal is to walk through each of the critical metrics, add new metrics as needed, and remove the old ones if the risk has been eliminated. When a trigger point occurs, it is time to review the action plan and launch it. Based on new knowledge, you may update and modify it. The secret, however, is to act and not wait for “things to get better” on their own because they rarely do.
Which Business Problems Do We Solve?
Risk management is the evil twin sister of innovation. Any break from the past is risky. One way to manage those risks is through micromanagement, but this tends to squelch innovation. Another way, consistent with the trend toward delegating authority and empowering teams, is to have the team manage risk on its own.
From a larger business perspective, having a risk management system in place helps improve project execution because the team can anticipate, prevent, and mitigate risks, preventing delays or additional project expenses. Unfortunately, while the team solves the problem, the schedule marches on and project expenses accumulate.
What Else You Should Know
The Risk Reduction Matrix is only as good as its initial inputs. Teams often add one or two principal engineers for this exercise to help them derive a deeper, more comprehensive, and more thoughtful list of risks.
While it is important to include the right people and follow a process when filling in the matrix, the assignment of values to the likelihood and the consequences can get out of hand. It is important that you try to identify the high- and medium-impact risks that also have a reasonably high likelihood of occurring. If you get stuck in assigning values, try pairwise comparison and cross-check the values you assigned.
The seduction of optimism is probably the biggest risk in the application of this tool. Don’t be a prisoner of hope, believing that the risk will just go away on its own or will be resolved by working harder. Make sure that when a risk trigger is crossed, you take action immediately.
Remember the clear perspective you had at the beginning of the project. What has changed? It is likely that nothing has changed except that you are now under pressure to deliver and have many other issues to worry about. Responding to the triggers is a better course than doing nothing while hoping for the best.