The risk management matrix

The risk management matrix complements Suns & Clouds and the composite risk index and 5×5 risk matrix. Its distinctive contribution is a third question: how manageable is the exposure?

When to use it

• Use the matrix as a call to action: identify how transfer, mitigation or redesign could make a strategy more robust.

Origins

Probability–impact matrices evolved across engineering safety, defence, insurance and project management rather than from one inventor. The manageability dimension extends that risk-triage tradition by separating severity from the organisation’s practical ability to influence likelihood or consequence.

What it is

The model plots each risk by impact and manageability, while circle size represents likelihood. It therefore distinguishes a severe but controllable execution risk from a severe external condition the company cannot influence. That distinction directs management effort towards the form of response that is feasible.

The categories are:

• Zero manageability: the event is beyond direct control, although its consequences may be insured, buffered or otherwise reduced. Market demand, industry supply, extreme weather and loss of key assets may fall here.
• Low manageability: influence is limited, as with competitor retaliation.
• Medium manageability: the organisation can adjust meaningfully, as with customer response to a product that can be improved.
• High manageability: management can redirect the activity readily, as with elements of a marketing initiative.

How to use it

Assemble the material risks from strategy development. Define scales and evidence, then rate likelihood and value impact consistently. Add a manageability assessment that distinguishes prevention from consequence reduction.

Plot manageability against impact and size each circle by likelihood.

The risk management matrix: an example

Key

High likelihood

The suns & clouds chart The composite risk index and the 5×5 risk matrix The risk management matrix

Medium Low

Risks below the diagonal are generally more manageable relative to their impact. Large circles near the high-impact, low-manageability region demand particular attention, contingency or reconsideration of the strategy.

For each point, ask whether the exposure can be avoided, transferred, treated or tolerated. Insurance may transfer financial consequence without transferring the operational disruption. A redesigned offer may improve manageability; a staged commitment may cap downside; an early-warning indicator may create decision time.

After selecting actions, plot residual risk separately and assign an owner and trigger. Do not simply move a circle because an action has been listed.

Top practical tip

For every severe exposure, separate what can change the event from what can reduce its consequence, then design the response accordingly.

Top pitfall

Like the composite risk index and 5×5 risk matrix, this tool can produce a threat-only conversation. Review opportunity and upside separately.

Further reading

• International Organization for Standardization (twenty eighteen). Risk Management—Guidelines. ISO.
• Project Management Institute (twenty twenty-one). A Guide to the Project Management Body of Knowledge. Project Management Institute.