7DIG: Ranking Risk

Filed under: Governance,Risk — lenand @ 9:09 am
Tags: , , , ,

The third and final part of the Quarkside risk method solves the problem of ranking, or prioritising, risk across any selected domain, large or small.   Other risk ranking methods eg a Risk Matrix, are too subjective and can miss  important  risks.

Crilog Risk Index

The Crilog Risk Index (CRI) evaluates risks consistently across whole organisations.  In a scale ranging between 0 and 100, it gives a single value for any risk impact between £1000 and £10 billion.  The absolute value is not significant; it is to allow ranking and setting priorities for risk reduction action plans.  A CRI value is calculated for every entry in a risk log.  It is a logarithmic function of the probability and impact of the risk.  Impact assessments only need to be “order of magnitude”.  The number of zeroes is all that really matters  and people are comfortable in saying that a risk is somewhere between £100k and £1million, for example.

After calculating the CRI, risk can be assessed according to which band it occurs and given a “Traffic Light” colour.   The ranges are arbitrary and can be modified to suit the risk appetite an organisation.

Colour Description Action CRI
Red Potential disaster Act now – advise directors 64 to 100
Yellow High risk Manage down 32 to 64
Green Manageable risk Monitor monthly 0 to 32

The major benefit of using this single value index is that it can be used on completely independent risks logs, whether they cover corporate, departmental or project risks.  At any time it is possible to merge risk logs and present a consolidated view of importance.

Crilog Risk Cube

Quarkside recommends adding an additional dimension to the traditional 2-dimensional risk matrix – to make a Risk Cube.

The Probability axis is linear from 0% to 100% and the Impact axis is a logarithmic scale that easily show £billions or even £trillions alongside £thousands.  The third axis is the Risk Index, which is coloured by traffic lights and a size proportional to the value.

Compared to the traditional matrix, the Cube graphically draws attention to important outliers, such as:

  • Risks that are almost certain to impact the bottom-line performance of a company; very high probability of loss
  • Risks that could potentially destroy a company; very low probability but very high impact.

Although it requires a culture change for people to allocate values to both the impact and probability of entries in the risk log, in practice it works well.  It produces clear method for ranking any magnitude of risk across different divisions or programmes.   It fits well with confidence measurement, in a non-threatening environment, as a small step towards using percentages for risk probabilities and orders of magnitude for risk impacts.

Monthly monitoring of changes to a Risk Index, at least for the high  values, show the health of projects and programmes.  It would be a miniscule proportional of  total expenditure for the benefits achievable.  Organisational leadership must now ensure that action takes place to remove, mitigate or minimise risk.



  1. […] 7DIG: Ranking Risk […]

    Pingback by 7DIG Risk Revisited: The Problem of Risk Matrices « Quarkside — 20/10/2011 @ 9:12 am | Reply

  2. […] the company threatening risk that is missed by using traditional risk matrices and resulted in the Risk Index to be described in the final […]

    Pingback by 7DIG: Identify Risk with Confidence « Quarkside — 20/10/2011 @ 9:49 am | Reply

  3. […] to identify which are truly the biggest programme risks.  Educating project teams to use the Crilog Risk Index is one possible way of ranking every risk in the Programme. Share this:ShareTwitterLike this:LikeBe […]

    Pingback by Low Confidence in Government ICT Strategy « Quarkside — 29/10/2011 @ 8:54 am | Reply

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Blog at WordPress.com.

%d bloggers like this: