The risk matrix is usually divided into a number of zones. Each zone is normally given a characteristic color to distinguish it from other zones. The illustration shows a 5x5 matrix divided into three zones, colored red, yellow and green.
The purpose of matrix zones is to divide the matrix into areas of different risk severity. In the example shown, the red zone represents high risks, the yellow zone moderate risks and the green zone low risks. Mandrel allows you to select the number of zones you wish to use. With four matrix zones, for example, you could use the matrix to classify risks as low, moderate, high and very high.
You can use up to 6 zones, except for a 2x2 matrix which is physically limited to a maximum of 4 zones.
Mandrel uses the following default set of colors for each zone, although you may alter this to colors of your own choice:
No. of Zones
|Red, yellow, green|
|Red, orange, yellow, green|
|Red, orange, yellow, green, pewter|
|Purple, red, orange, yellow, green, pewter|
The severity of any risk is determined not only by its impact and probability but also by the relative importance placed on these two quantities. Many people consider impact to be more important than probability in determining risk severity. In this view, for example, a low probability of a large financial loss is considered to be a greater risk than a high probability of a small financial loss, which probably explains the existence of the insurance industry.
The way the boundaries are drawn between risk matrix zones expresses the relative importance placed on impact and probability. If you believe that impact and probability are of equal importance you would use a symmetric matrix, whereas if you believe that impact is somewhat more important than probability you would use a matrix skewed towards the impact axis, or one skewed towards the probability axis if you believe probability is more important than impact:
Mandrel provides complete control over matrix zone boundaries.
Matrix zones can be drawn on an ad hoc basis, or they can be controlled by an algorithm. Mandrel provides for both approaches.
Any algorithm linking risk severity to impact and probability must provide for all possible cases. One possible algorithm would be:
Risk Severity = Probability x (Impact)N ............ (1)
where both probability and impact are expressed as simple numerical values, and N is a numeric constant. N = 1 would give a symmetric matrix, N > 1 would give a matrix skewed towards the impact axis (impact more important than probability), while N < 1 would give a matrix skewed towards the probability axis (probability more important than impact).
Another, and simpler, version of this algorithm is:
Risk Severity = Probability + (N x Impact) ............ (2)
which is mathematically acceptable since probability and impact are both dimensionless quantities. This algorithm is used by Mandrel to calculate risk severity levels.
Suppose we have a 5x5 matrix, and probability is measured in the same way as impact, with a 1-5 scale. Using algorithm (2) with N = 2 gives us risk severity values ranging from 3 (impact and probability both 1) to 15 (impact and probability both 5). Risk severity ranges for a 3-zone matrix could then be identified as:
Major risks 12-15
Moderate risks 8-11
Minor risks 3-7
This results in the matrix shown at the top of this page, and is used by Mandrel as its default matrix configuration.
Mandrel provides the ability to define zone boundaries by specifying the value of N and then applying algorithm (2). This is known as Automatic mode. Mandrel also provides the ability to specify which matrix element belongs to which zone on a manual basis (Manual mode).