The risk management matrix

The risk management matrix complements Suns & Clouds and the composite risk index and 5×5 risk matrix. Its distinctive contribution is a third question: how manageable is the exposure?

When to use it

Use the matrix as a call to action: identify how transfer, mitigation or redesign could make a strategy more robust.

Origins

Probability–impact matrices evolved across engineering safety, defence, insurance and project management rather than from one inventor. The manageability dimension extends that risk-triage tradition by separating severity from the organisation’s practical ability to influence likelihood or consequence.

What it is

The model plots each risk by impact and manageability, while circle size represents likelihood. It therefore distinguishes a severe but controllable execution risk from a severe external condition the company cannot influence. That distinction directs management effort towards the form of response that is feasible.

The categories are:

Zero manageability:

the event is beyond direct control, although its consequences may be insured, buffered or otherwise reduced. Market demand, industry supply, extreme weather and loss of key assets may fall here.

Low manageability:

influence is limited, as with competitor retaliation.

Medium manageability:

the organisation can adjust meaningfully, as with customer response to a product that can be improved.

High manageability:

management can redirect the activity readily, as with elements of a marketing initiative.