One More Time: Do Acute Or Chronic Risks Matter Most?
When to use the 5X5 risk matrix and when to avoid it
The controversy over using the 5X5 risk matrix will never end. On one hand, risk matrices are quick, intuitive, and commonly used. This makes them acceptable for corporate and most community-based stakeholder settings. On the other hand, like the squirrels my back yard, risk matrices have limited usefulness.
The fundamental question when it comes to evaluating risk is whether a few things with big value (acute risks) are more important that the many things will low value (chronic risks). The short answer, like all of risk, is that it matters where you sit (the context). Risk matrices are a simple way to normalize the acute and chronic cases to enable decision making.
Healthcare Example
A simple example comes from the healthcare industry. A surgical error occurs rarely but when it does occur it costs the hospital $3,000,000. This is an acute problem since it hurts badly and has the potential to be catastrophic to the hospital.
The same hospital also draws blood thousands of times each year. It costs $300 to re-draw a blood sample and for some reason the hospital does it 1,000 times per year. Total costs are $3,000,000 but no one really feels any short-term consequences.
Which is more important? Both cost the hospital the same amount of money. However, in most cases the acute problem (the surgical error) will be addressed as the bigger risk. The risk matrix is a method to look at this under a common framework and to help develop consensus among all the hospital stakeholders as to whether the acute risk is more important.
The 5X5 Risk Matrix
Risk matrices are two-dimensional graphs. One axis represents the consequences of the risk and the other axis represents the likelihood of its occurrence. Qualitative scales of 1 to 5 are common, hence the classic reference to a 5X5 risk matrix. When colors like red, yellow, and green are added to depict the gradation of risks, the risk matrix also becomes known as a heat map to risk management professionals.
Now let’s go back to the hospital example. Why use a risk matrix if we have data from the past? The short answer is we should not. Just plug in the numbers and compare the results.
The long answer is two-fold. The first part is that we often do not have the data and that past data may not be a good predictor of the future. The second part is that different stakeholders have different concerns and to reach consensus it may not be acceptable to quantify everything into money.
Building Consensus
Risk matrices are powerful consensus-building tools that are easily transferable into understandable graphics. Risk matrices can also be used as a powerful prioritization tool without requiring a lot of data. Multiple criteria (multi-criteria) approaches, especially when dealing consequence, provide an advantage to building consensus by offering insight into “by how much” or “why” one item is preferred to another.
The drawback with multi-criteria approaches is that they involve considerably more time than other approaches such as simple ranking. The additional time is the result of the scales and measures that need to be created — which also requires consensus. In terms of qualitative (“1 to 5”, “great to poor”) risk matrices, a multi-criteria approach takes a lot more time than other risk analysis methods if done well. The irony is that a qualitative risk matrix is regarded as a simplified approach, yet the underpinning theory requires a substantial amount of time.
Risk by Other Methods
ISO 31010 provides many tools and techniques that may be appropriate when assessing risk in different contexts. Some of these tools require more opinion than data while others require large amounts of data. The main point to be taken is that risk management is not limited by the classic risk equation or by an extension of it, the risk matrix.
All the methods leave out the important aspect of time because the definition of risk does not include the element of time. Time is left to the interpretation of the user. It is a key reason that risk depends on where you sit. It is also the reason why a short-term acute risk is often evaluated to be more important than a longer-term chronic risk. The final evaluation of risk is in the eye of the beholder, regardless of what tool or technique you use.
Hawk or Squirrel?
I look at the hawk who frequents my backyard and I think of what a savvy, three-dimensional predator he is. I sometimes feel sympathy for the thinning group of squirrels because they have little purpose except to gather and store mainly in simple, two-dimensional terms.
I look at risk matrices and people who use them exclusively much the same as I look at squirrels — they are harmless, have limited purpose, and are two dimensional. Like squirrels gathering nuts and seeds with looking up, users of risk matrices normalize the few things that matter a lot with the many things that matter a little. Even worse, the nuts and seeds are distinguished only by descriptions, colors, or ordinal numbers.
The hawk is much more discerning and has more range. Always thinking in three dimensions, one type of environment is preferable to another and different forms of prey are more desirable than others.
One more time: the use of a risk matrix depends on context. The main goal of the risk matrix is to build consensus. It is a starting point for prioritization. There are better tools and techniques for different contexts. And sometimes chronic risks are more important than acute ones. You have a choice of whether to use a risk matrix most of the time or not, just like squirrels are happy and harmless. Or you can be discerning and have more range like the hawk. I say be the hawk.
