Likelihood, impact, and who answers for it

The problem it solves

Most risk matrices in a small company are built once, usually because somebody outside asked for one, and never opened again. They look the part: colors, boxes, a sheet that can be shown. And they change no decision, because they are missing the one thing that makes a matrix work.

What they are missing is rarely technical rigour. It is that nobody wrote down how much of each risk the company is willing to tolerate before acting, nobody put an individual name beside each row, and nobody set a date to look again. With no threshold there is no trigger; with no owner there is nobody to act; with no date the matrix quietly ages while the operation changes underneath it. And likelihood gets estimated on a scale nobody defined, so high means different things to the operations manager and to the owner, and both of them believe they agree.

Meanwhile, attention and money drift towards the risks that get discussed most, which are not always the ones that weigh most. The real cost shows up on the day one of them materializes: the response is improvised, because nobody decided in advance what would be done or by whom, and the first hours go on working out whose job it was to watch it. Left alone, the matrix gets rebuilt every time a third party asks for it, and the company mistakes having one for managing its risks.

What it covers

The workshop builds a matrix on the real risks of the companies in the room, not on a practice case, and it starts from an idea that organizes everything else: a matrix is worth the decisions it triggers, not how complete it looks. No decision gets triggered while each person reads the matrix their own way, so the work begins with the step usually skipped, which is defining the scale. What likely means in this organization, over what time horizon, and what a high impact means when it is measured in money, in operations stopped, in non-compliance or in a client relationship.

Once the scale is agreed, each participant places their own company's risks independently, and only then are the positions compared. The argument matters more than the final position: when two people from the same company put the same risk in opposite corners, the conversation that follows usually uncovers that they were describing two different risks under one name. The same round practices the discipline of leaving minor risks out, and of marking as an estimate anything with no evidence behind it, so that it gets verified later instead of argued from memory.

The last part assigns. Every row leaves with an individual owner rather than a department, a threshold that defines when action is taken, the agreed action, and a review date. The threshold is the hardest part, because it forces people to say out loud how far the company will watch a risk without stepping in, and at what signal it stops watching. The group also agrees what gets recorded when a risk materializes, so that the next review works from what happened rather than from what people remember.

Finally the cadence is set: what gets looked at monthly, what quarterly, and what only when something changes. A matrix without that calendar is a document. With it, it is an instrument. Each company leaves with its matrix populated in the room, its scales written in terms its own team recognizes, a name and a threshold on every row, and the next review already carrying an owner and a date. Setting each threshold forces leadership, not whoever keeps the register, to say how much the company is prepared to risk to hold to its plan, and that decision is where this workshop meets ALUD's work in Strategy.

What participants learn

• Define likelihood and impact scales that mean the same thing across the organization.
• Place real risks using the evidence available rather than impressions.
• Set tolerance thresholds that say when action is taken and when it is not.
• Assign an individual owner and an agreed action to every risk on the register.
• Establish a review cadence the organization can actually sustain.

Agenda

1. 01What makes a matrix change decisions, and what leaves it as a document
2. 02Likelihood scales: defining them before using them, and over what horizon
3. 03Impact measured in money, in stopped operations, in non-compliance and in relationships
4. 04Calibration: why high means different things inside the same room
5. 05Tolerance: the threshold that separates monitoring from acting
6. 06Individual owner against departmental responsibility
7. 07Agreed action, evidence, and what gets recorded when a risk materializes
8. 08Review cadence: monthly, quarterly or event-driven

What the organization leaves with

• A risk matrix for your company, populated during the session.
• Your organization's likelihood and impact scales, defined in writing.
• A tolerance threshold and a named owner for every risk on the register.
• A review calendar with a responsible person and the date of the next session.