See discussions, stats, and author profiles for this publication at: https://www.researchgate.
net/publication/310802191
What’s Wrong with Risk Matrices? Decoding a Louis Anthony Cox
paper
Presentation · March 2011
DOI: 10.13140/RG.2.2.23469.69601
CITATIONS READS
0 4,463
1 author:
Antonio Quintino
Technical University of Lisbon
13 PUBLICATIONS 30 CITATIONS
SEE PROFILE
Some of the authors of this publication are also working on these related projects:
Reshaping dowsntream configuration View project
An integrated risk management model for an oil and gas company View project
All content following this page was uploaded by Antonio Quintino on 25 November 2016.
The user has requested enhancement of the downloaded file.
What’s Wrong with Risk Matrices?
Decoding a Louis Anthony Cox paper.
Author: António Quintino
What’s Wrong with Risk Matrices?
Risk matrices have been widely praised and adopted as simple, effective
approaches to risk management. They provide a clear framework for
systematic review of individual risks and portfolios of risks; convenient
documentation for the rationale of risk rankings and priority setting.
But… “risk” is not a measured attribute, but is derived from frequency
and severity inputs through a priori specified formulas such as:
Risk = Frequency × Severity.
This article explores fundamental mathematical and logical limitations
of risk matrices as sources of information for risk management decision
making and priority setting.
1. A NORMATIVE DECISION-ANALYTIC FRAMEWORK What’s Wrong with Risk Matrices?
How well can the information provided by the risk matrix be used to
identify the quantitatively greater risk?
1. A NORMATIVE DECISION-ANALYTIC FRAMEWORK What’s Wrong with Risk Matrices?
However, the simplest case of a 2 × 2 risk matrix does suggest it is not
necessarily true that risk matrices provide qualitatively useful
information for setting risk priorities.
2. LOGICAL COMPATIBILITY OF RISK MATRICES WITH What’s Wrong with Risk Matrices?
QUANTITATIVE RISKS
LEMMA 1. If a risk matrix satisfies weak consistency, then no red cell
can share an edge with a green cell.
LEMMA 2: If a risk matrix satisfies weak consistency and has at least two
colors (“green” in the lower left cell and “red” in the upper right cell, if
axes are oriented to show increasing frequency and severity), then no
red cell can occur in the left column or in the bottom row of the risk
matrix.
DEFINITION OF BETWEENNESS: A risk matrix satisfies the axiom of
betweenness if every positively sloped line segment that lies in a green
cell at its lower (left) end and in a red cell at its upper (right) end passes
through at least one intermediate cell (meaning one that is neither
green nor red) between them.
2. LOGICAL COMPATIBILITY OF RISK MATRICES WITH What’s Wrong with Risk Matrices?
QUANTITATIVE RISKS
DEFINITION OF CONSISTENT COLORING.
(1) A cell is red if it contains points with quantitative risks at least as
high as those in other red cells (and does not contain points with
quantitative risk as small as those in any green cell).
(2) A cell is colored green if it contains some points with risks at least as
small as those in other green cells (and does not contain points with
quantitative risks as high as those in any red cell).
(3) A cell is colored an intermediate color (neither red nor green) only if
either (a) it lies between a red cell and a green cell; or (b) it contains
points with quantitative risks higher than those in some red cells and
also points with quantitative risks lower than those in some green
cells.
2. LOGICAL COMPATIBILITY OF RISK MATRICES WITH What’s Wrong with Risk Matrices?
QUANTITATIVE RISKS
2. LOGICAL COMPATIBILITY OF RISK MATRICES WITH What’s Wrong with Risk Matrices?
QUANTITATIVE RISKS
3. RISK MATRICES WITH TOO MANY COLORS OR What’s Wrong with Risk Matrices?
LEVELS GIVE SPURIOUS RESOLUTION
3. RISK MATRICES WITH TOO MANY COLORS OR What’s Wrong with Risk Matrices?
LEVELS GIVE SPURIOUS RESOLUTION
There's 13 priority levels as possible outputs, Anything that is in the box
labeled “1” is the highest priority.
4. RISK RATINGS DO NOT NECESSARILY SUPPORT What’s Wrong with Risk Matrices?
GOOD RESOURCE ALLOCATION DECISIONS
Suppose that a risk manager can afford to eliminate all but one of the following
three risks: (A) lose $95 with certainty; (B) lose $75 with certainty; (C) lose $95
with probability 50% (else lose nothing). Which one should she keep to
minimize risk (here defined as expected loss)? The answer is (C).
4. RISK RATINGS DO NOT NECESSARILY SUPPORT What’s Wrong with Risk Matrices?
GOOD RESOURCE ALLOCATION DECISIONS
Now, suppose that all potential losses are reduced by $15, so that the new
alternatives are: (A’) lose $80 with certainty; (B’) lose $60 with certainty; (C’)
lose $80 with probability 50% (else lose nothing). We should now choose to
keep (B’)
4. RISK RATINGS DO NOT NECESSARILY SUPPORT What’s Wrong with Risk Matrices?
GOOD RESOURCE ALLOCATION DECISIONS
Thus, reducing the potential loss by the same amount for all three risks changes
the prescribed priority ordering among them. This violates the principle of
translation invariance for coherent risk measures. Moreover, keeping (B’)
instead of (C’) is inconsistent with minimizing risk. Thus, the risk matrix does
not necessarily support effective risk management decision.
4. RISK RATINGS DO NOT NECESSARILY SUPPORT What’s Wrong with Risk Matrices?
GOOD RESOURCE ALLOCATION DECISIONS
A risk manager has identified the following three risk reduction opportunities:
A: reduces risk from 100 to 80. It costs $30: B: reduces risk from 50 to 10. It costs
$40. C: reduces risk from 25 to 0. It costs $20. How should a risk matrix
categorize A, B, and C to support the goal of achieving the largest risk
reduction from allocation of limited funds? The answer depends on the
budget!
4. RISK RATINGS DO NOT NECESSARILY SUPPORT What’s Wrong with Risk Matrices?
GOOD RESOURCE ALLOCATION DECISIONS
For a budget of $40, the largest feasible risk reduction is achieved by funding
B, so the best priority order puts B first. If the budget is $50, then funding
A and C achieves the greatest risk reduction, so B should be ranked last.
At $60, the best investment is to fund B and C, so now A should be ranked
last..
4. RISK RATINGS DO NOT NECESSARILY SUPPORT What’s Wrong with Risk Matrices?
GOOD RESOURCE ALLOCATION DECISIONS
In short, no categorization or rank-ordering of A, B, and C, optimizes
resource allocation independent of the budget.
Calculating optimal risk management resource allocations requires
quantitative information beyond what a risk matrix provides, for
example, about budget constraints and about interactions
among countermeasures.
In general, risk rankings calculated from frequency and severity do
not suffice to guide effective risk management resource
allocation decisions.
5. SEVERITY RATINGS DEPEND ON SUBJECTIVE RISK What’s Wrong with Risk Matrices?
ATTITUDES
For a decisionmaker with an exponential utility function, the certainty
equivalent (CE) value of a prospect with normally distributed
consequences is CE(X) = E(X) − k × Var(X),
where:
k is a parameter reflecting subjective risk aversion (k = 0.5 × coefficient of
risk aversion);
E(X) is the mean of prospect X;
Var(X) is its variance;
CE(X) is its certainty-equivalent value (i.e., the deterministic value that is
considered equivalent in value to the uncertain prospect)
5. SEVERITY RATINGS DEPEND ON SUBJECTIVE RISK What’s Wrong with Risk Matrices?
ATTITUDES
Consider three events, A, B, and C, with identical probabilities or
frequencies and having normally distributed consequences (on some
outcome scale) with respective means of 1, 2, and 3 and respective
variances of 0, 1, and 2. The certainty equivalents of prospects A, B, and
C are:
CE(A) = 1 ; CE(B) = 2 − k ; CE(C) = 3 − 2k
For a risk-neutral
decisionmaker with k = 0:
C>B>A
5. SEVERITY RATINGS DEPEND ON SUBJECTIVE RISK What’s Wrong with Risk Matrices?
ATTITUDES
Consider three events, A, B, and C, with identical probabilities or
frequencies and having normally distributed consequences (on some
outcome scale) with respective means of 1, 2, and 3 and respective
variances of 0, 1, and 2. The certainty equivalents of prospects A, B, and
C are:
CE(A) = 1 ; CE(B) = 2 − k ; CE(C) = 3 − 2k
For a risk-averse
decisionmaker with k = 1:
A=B=C
5. SEVERITY RATINGS DEPEND ON SUBJECTIVE RISK What’s Wrong with Risk Matrices?
ATTITUDES
Consider three events, A, B, and C, with identical probabilities or
frequencies and having normally distributed consequences (on some
outcome scale) with respective means of 1, 2, and 3 and respective
variances of 0, 1, and 2. The certainty equivalents of prospects A, B, and
C are:
CE(A) = 1 ; CE(B) = 2 − k ; CE(C) = 3 − 2k
For a more risk-averse
decisionmaker with k = 2:
A>B>C
5. SEVERITY RATINGS DEPEND ON SUBJECTIVE RISK What’s Wrong with Risk Matrices?
ATTITUDES
Risk matrices typically do not specify or record the risk attitudes of those
who use them.
Users with different risk
attitudes might have
opposite orderings, as in
this example.
As a result there is no
objective way to classify
the relative severities of
such prospects with
uncertain consequences.
6. PRAGMATIC LIMITATIONS OF GUIDANCE FROM What’s Wrong with Risk Matrices?
STANDARDS
How should one rate the severity of a consequence that consists of 1
death and 1 severe injury compared to that of a consequence of 0
deaths but 50 severe injuries? The answer is not obvious from the
example below!
7. INAPPROPRIATE RISK RATINGS IN ENTERPRISE What’s Wrong with Risk Matrices?
MANAGEMENT
Suppose that a company must choose between the following two risky
investment strategies:
Strategy A has probability 0.1% of leading to a 1% growth rate that barely
meets shareholder expectations (outcome A1); otherwise (probability
99.9%) shareholder value and growth will increase by a negligible
amount (0.0001%), disappointing shareholders (outcome A2).
Strategy B has probability 50% of causing 5% sustained growth that greatly
exceeds shareholder expectations (outcome B1); otherwise,
shareholder value and growth rate = 0%, enraging shareholders.
(outcome B2).
Which strategy, A or B, better matches a responsible company’s
preferences (or “risk appetite”) for risky strategic investments?
7. INAPPROPRIATE RISK RATINGS IN ENTERPRISE What’s Wrong with Risk Matrices?
MANAGEMENT
Implementing the discrete categorization criteria in the guidance could
distract attention from the fact that most shareholders would gladly
trade a negligible increase in adverse consequences for a large increase
in the probability of a much better outcome.
8. CONCLUSION What’s Wrong with Risk Matrices?
In the terminology of multicriteria decision making, the discrete
categorization of consequences and probabilities inherent in risk
matrices can produce noncompensatory decision rules that do not
reflect the risk trade-off preferences of real decisionmakers and
stakeholders.
So, resuming, Risk matrices do not necessarily support good (e.g., better-
than-random) risk management decisions and effective allocations of
limited management attention and resources.
Research is needed to better characterize conditions under which they are
most likely to be helpful or harmful in risk management decision
making and that develops methods for designing them to maximize
potential decision benefits and limit potential harm from using them.
What’s Wrong with Risk Matrices?
Chapter end
View publication stats
