Accendo Reliability

Your Reliability Engineering Professional Development Site

  • Home
  • About
    • Contributors
    • About Us
    • Colophon
    • Survey
  • Reliability.fm
  • Articles
    • CRE Preparation Notes
    • NoMTBF
    • on Leadership & Career
      • Advanced Engineering Culture
      • ASQR&R
      • Engineering Leadership
      • Managing in the 2000s
      • Product Development and Process Improvement
    • on Maintenance Reliability
      • Aasan Asset Management
      • AI & Predictive Maintenance
      • Asset Management in the Mining Industry
      • CMMS and Maintenance Management
      • CMMS and Reliability
      • Conscious Asset
      • EAM & CMMS
      • Everyday RCM
      • History of Maintenance Management
      • Life Cycle Asset Management
      • Maintenance and Reliability
      • Maintenance Management
      • Plant Maintenance
      • Process Plant Reliability Engineering
      • RCM Blitz®
      • ReliabilityXperience
      • Rob’s Reliability Project
      • The Intelligent Transformer Blog
      • The People Side of Maintenance
      • The Reliability Mindset
    • on Product Reliability
      • Accelerated Reliability
      • Achieving the Benefits of Reliability
      • Apex Ridge
      • Field Reliability Data Analysis
      • Metals Engineering and Product Reliability
      • Musings on Reliability and Maintenance Topics
      • Product Validation
      • Reliability by Design
      • Reliability Competence
      • Reliability Engineering Insights
      • Reliability in Emerging Technology
      • Reliability Knowledge
    • on Risk & Safety
      • CERM® Risk Insights
      • Equipment Risk and Reliability in Downhole Applications
      • Operational Risk Process Safety
    • on Systems Thinking
      • Communicating with FINESSE
      • The RCA
    • on Tools & Techniques
      • Big Data & Analytics
      • Experimental Design for NPD
      • Innovative Thinking in Reliability and Durability
      • Inside and Beyond HALT
      • Inside FMEA
      • Institute of Quality & Reliability
      • Integral Concepts
      • Learning from Failures
      • Progress in Field Reliability?
      • R for Engineering
      • Reliability Engineering Using Python
      • Reliability Reflections
      • Statistical Methods for Failure-Time Data
      • Testing 1 2 3
      • The Manufacturing Academy
  • eBooks
  • Resources
    • Accendo Authors
    • FMEA Resources
    • Glossary
    • Feed Forward Publications
    • Openings
    • Books
    • Webinar Sources
    • Podcasts
  • Courses
    • Your Courses
    • Live Courses
      • Introduction to Reliability Engineering & Accelerated Testings Course Landing Page
      • Advanced Accelerated Testing Course Landing Page
    • Integral Concepts Courses
      • Reliability Analysis Methods Course Landing Page
      • Applied Reliability Analysis Course Landing Page
      • Statistics, Hypothesis Testing, & Regression Modeling Course Landing Page
      • Measurement System Assessment Course Landing Page
      • SPC & Process Capability Course Landing Page
      • Design of Experiments Course Landing Page
    • The Manufacturing Academy Courses
      • An Introduction to Reliability Engineering
      • Reliability Engineering Statistics
      • An Introduction to Quality Engineering
      • Quality Engineering Statistics
      • FMEA in Practice
      • Process Capability Analysis course
      • Root Cause Analysis and the 8D Corrective Action Process course
      • Return on Investment online course
    • Industrial Metallurgist Courses
    • FMEA courses Powered by The Luminous Group
    • Foundations of RCM online course
    • Reliability Engineering for Heavy Industry
    • How to be an Online Student
    • Quondam Courses
  • Calendar
    • Call for Papers Listing
    • Upcoming Webinars
    • Webinar Calendar
  • Login
    • Member Home
  • Barringer Process Reliability Introduction Course Landing Page
  • Upcoming Live Events
You are here: Home / Articles / Crazy Risk Management with a Risk Matrix

by Mike Sondalini Leave a Comment

Crazy Risk Management with a Risk Matrix

Crazy Risk Management with a Risk Matrix

A risk management risk matrix can trick you into leaving high consequences uncontrolled and convince you it is fine to do nothing to reduce the impacts of failure. Whether you think a bad event cannot happen has no standing in Law. The likelihood of an adverse event is unimportant; only the resultant severity is how the Law will gauge your risk abatement efforts. Did you do ‘reasonably practicable’ risk control?

Keywords: risk management, risk matrix, risk mitigation, risk control

One of the biggest dangers you face when you do risk management is you will use a risk matrix and believe it. A standard risk matrix is developed using mathematically correct principles, hardly any of which you should use to manage risk in the real business world. If you use a risk matrix to justify your choices to do nothing because the risk is so low, you are doing crazy risk management with a risk matrix.

When you manage your personal risk you do not use a risk matrix. You only cross a road when you are confident you will not be hurt during the passage. You do not first look up a risk matrix to determine if the consequence and likelihood multiply together low enough to make crossing the road a journey you are willing to take. You do not want to be hurt at all. It is the consequential harm you want to prevent and you will wait at the side of the road until the traffic conditions are clearly safe for the crossing. Managing risk in a business or the workplace also should not be based solely on using a risk matrix. The logic in a risk matrix is crazy if you use it literally for decision making at work or in your own life.

Figure 1 is a 16×13 risk matrix developed from the advice in ISO 31000-2009 Risk management – Principles and guidelines. It is just a 5×5 risk matrix expanded to 16×13 by adding more columns and rows to show the minor values between the major units. I would prefer that real log10 scales be used in a risk matrix; that would at least be mathematically correct. It would actually make the matrix useful to see the amount of risk move as you selected mitigation options.

Figure 1 reflects risk for a small business. The acceptable risk boundary is set at a total business-wide loss of $3,000 per year from one adverse event. Meaning the small business will accept a Total Defect and Failure Cost to the operation of up to $3,000 per event per year and do nothing to prevent the risk happening. Mathematically that is the same as if you lost $300 ten times a year, or you lost $30,000 once every ten years—the annual average is $3,000. Risks identified to be above the TDAF Cost boundary are addressed to bring the remaining risk down to below the boundary value. If you controlled risk in the real business world like that you would often be legally wrong.

After the North Sea Piper Alpha oil platform disaster in 1988, legislation and regulations started applying the ALARP, as low as reasonably practicable, judgement on what is legally acceptable risk. The acceptable risk boundary on a risk matrix counts for nothing in Law. What you thought was sufficiently low risk by your risk management risk matrix does not count. What counts is did you make the risk as low as reasonably practicable? What was ‘Reasonably Practicable’ in the given situation and context is the measure used in Law. That is not the same as what you think is acceptable risk according to the risks you are willing to carry.

The legal view that has developed over the years is that risk should be SFAIRP (“So Far As Is Reasonably Practicable (SFAIRP)”, National Transport Commission, Melbourne, Australia, 2007). “In essence, it requires weighing the risk against the resources needed to eliminate or reduce the risk. It does not require every possible measure to be implemented to eliminate or reduce risk, but it places the onus on the person holding the duty to demonstrate (or be in a position to demonstrate) that the cost of additional measures to control the risk (over and above those risk controls already in place) would be grossly disproportionate to the benefit of the risk reduction associated with the implementation of the additional risk control.” It requires going to the fullest extent to cut risk that is technically and financially justifiable in the circumstances, no matter how unlikely you think an event is to happen. The consequence of a risk is what matters most; the likelihood of the risk is a far, far smaller consideration.

You would be wise to realize any risk management risk matrix used in a business is purely a financial tool to help make business decisions. It is not to be used alone to justify the acceptance of a business risk, and definitely not for a workplace safety risk.

Even as a financial tool a risk matrix can get you making crazy business decisions. If you use the risk boundary on a risk matrix to make accept-or-reject business risk choices you will lose a lot of money, maybe even go out of business. For our small business that accepts a $3,000/yr. loss event with a shrug, it does not also mean they do nothing for a $30,000 event that happens on average once every 10 years. Can this business afford a $30,000 loss event at any time? Can it afford a $300,000 loss event that on average happens once in a hundred years, and it happens to them today? Around the world hundred-year events happen all the time. If you used the mathematical value of risk for a hundred-year event you would do nothing to prevent it because it would be such a low likelihood. But mathematical risk is not important—it is the consequence of the risk should the event happen that must be your prime consideration in choosing risk abatements. Applying the mathematical average risk makes for crazy risk taking. What consequential size of a single adverse event can your business afford to pay from its own pocket and still survive to continue trading? That is a better view to have of risk than a purely mathematical consideration.

If this small business can only handle one $30,000 consequential TDAF Cost event and still continue trading, then it must not have a $30,001 event at any time, and it must not enter into situations where a $300,000 disaster is even a very rare outcome. Risks either above the ‘event risk boundary’ or the ‘event consequence boundary’ in Figure 1 are unacceptable and should be mitigated to below both boundaries. This small business needs to carry insurance for any adverse event that costs more than $30,000 should it happen. For its safety risks it must drive them all to SFAIRP, which on the matrix in Figure 1 will be far closer to the left-hand bottom corner than the ‘event risk boundary’ indicates.

When can you only use a risk management risk matrix for making decisions? Probably never is the safe answer. A risk matrix is only a mathematical device to help you visualize risk. It is not the answer to controlling risk. Use a risk matrix to show you the potential remaining severity after implementing your choices. Do not use a risk matrix to make the choices for you. Doing that will one-day get you into deep trouble, because you’ve done crazy risk management with a risk matrix.

Filed Under: Articles, Life Cycle Asset Management, on Maintenance Reliability

About Mike Sondalini

In engineering and maintenance since 1974, Mike’s career extends across original equipment manufacturing, beverage processing and packaging, steel fabrication, chemical processing and manufacturing, quality management, project management, enterprise asset management, plant and equipment maintenance, and maintenance training. His specialty is helping companies build highly effective operational risk management processes, develop enterprise asset management systems for ultra-high reliable assets, and instil the precision maintenance skills needed for world class equipment reliability.

« Job Safety Analysis – Part 1
Bathtub Curve and Human Mortality »

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Headshot of Mike SondaliniArticles by Mike Sondalini
in the Life Cycle Asset Management article series

Join Accendo

Receive information and updates about articles and many other resources offered by Accendo Reliability by becoming a member.

It’s free and only takes a minute.

Join Today

Recent Posts

  • Gremlins today
  • The Power of Vision in Leadership and Organizational Success
  • 3 Types of MTBF Stories
  • ALT: An in Depth Description
  • Project Email Economics

© 2025 FMS Reliability · Privacy Policy · Terms of Service · Cookies Policy