Risk matrices are probably the inter-industry safety standard as the primary tool used in risk evaluation. In aviation safety management systems (SMS) they are ubiquitous.
Risk matrices are simplistic charts (though not necessarily “simple”) that use “probability” and “severity” to quantify the risk priority of a real or hypothetical safety scenario. The quantification is generally broken into 3 categories:
Some organizations use 1 or 2 additional colors, such as light green and/or orange, though these colors only provide further “aesthetic” and risk granularity rather than general quantification. Risk matrices are ultimately used as risk management tools to rank risks with the risk grid and the calculated risk indices.
The risk matrix is broken into a grid. The grid is usually 5x5, though it can be larger or smaller depending on company needs – we will use a 5x5 grid in this article, which happens to be the ICAO default risk matrix. The grid is used to assign a calculated “number” to the risk, which is a combination of Probability x Severity and represents the risk priority.
The risk matrix grid:
We will consider the most common use of risk matrices, from left to right and bottom to top. As you can see, there is a lot of flexibility about how the risk matrix "appears" or is "laid out." What matters most is that it is:
Despite the fact that a risk matrix only contains two variables, there is a surprising amount of confusion or misunderstanding about how to use it. I constantly see different opinions about how to use it – some of these opinions are better than others. We will look at the probability and severity below, and then consider the 2 “best use cases” of a risk matrix during risk assessment.
Risk matrix probability can be used by companies in a few different ways, depending on how an organization defines “probability.” Probability can also mean likelihood or frequency, and is commonly known as ranging from “extremely rare in the industry” to “reported often in the company.”
Probability can be used to quantify:
Many companies use probability to assess the likelihood of consequences in their SMS' documented risk management processes, though I also highly advocate using it for point #1 because point #1 is “risk event-specific” and, in my experience, a risk event’s probability is easier to assess than the likelihood of potential consequences.
Likelihood is assigned a letter value for each increment in likelihood. Low probability is assigned A, while high likelihood (in a 5x5 grid) is assigned an E. Low likelihood events mean that either the risk event/consequences are uncommon OR that good risk controls are in place to effectively mitigate the probability.
Severity in risk matrices is more straightforward than probability. Severity is a consideration of:
Severity is given on a scale in either letters or numbers, depending on your preference. In the example above, the risk matrix uses letters A, B, C, D, and E, with "A" being the most severe. There are also risk matrices with numbers. For example, a risk matrix could start at 1 (low severity), and increment up by 1 for each row. In a 5x5 risk matrix grid, high severity would be assigned a value of 5.
The advantage of using numbers is that the math is a simple multiplication of probability and severity; however, one could easily assign numeric values to the letters, as in the above risk matrix. For example, A would equal 5.
Severity is generally considered as ranging from:
High-severity risk assessments should require extensive investigations by a company and every available resource to mitigate the exposure of the safety incident.
When it comes to using a risk matrix for a risk assessment in your SMS' risk management processes, there are 2 primary approaches that companies adopt. It’s important to remember the purpose of using risk matrices in risk assessments:
A risk matrix is a bad tool for making decisions. It is designed to provide a number/letter combination to rank/prioritize an event. During risk assessment, the combination of probability and severity that is decided upon will provide the number/letter combo. Some examples for a 5x5 grid are:
The numbers provide a powerful way to assess a company’s historical exposure to risk. For example, by tracking each reported safety issue’s risk index (calculation of severity and probability) in an aviation SMS database or Excel spreadsheet, a company could easily assess averages and frequency of certain severities and/or probabilities occurring.
Even though we discuss the visual aspects of a risk matrix as being integral to its use in risk assessments, a risk matrix can be used even without “physically” having the chart. For example, in an Excel spreadsheet you could:
A risk matrix is just a helpful visual tool for making these assessments.
The most useful aspect of using risk assessments in the SMS risk management process relates to prioritizing the treatment of reported safety issues and audit findings. The safety issue's desired deadline for treating the safety issue is based on the risk assessments. High-priority safety issues are naturally processed first.
After completing the risk assessment, management understands the risk priority of the safety issue and can manage accordingly. There is a documented process, and this documentation will reside in your SMS manual.
Last updated June 2024.