Module 7.5 – Practical Guidance on Using the Risk Matrix

You have now learned the steps required for setting up a systematic and graphic way to assess the risk of various threats in your working environment and to communicate your analysis to others.

The idea is simple, but, several practical measures should be taken in using this analysis in the field.

Some practical tips on drawing up your own risk matrix

• The risk matrix is an especially useful tool when used with other staff or partners. Conducting this analysis with a group of people with different expertise or backgrounds can bring new information and helps overcome individual biases.
• The Risk Matrix is a flexible tool that can be used at different scopes and scales. National-level managers may need to do the exercise at the country level to set overall program budgets and to plan appropriately. Smaller offices in remote districts may be more concerned with their day-to-day operations and will only need to analyse threats within the scope of their own local situation.
• If you are in a fairly dangerous area, and you are trying to determine how best to carry out your operations under local threats, you should focus specifically on the area(s) in which you work. However, remember the principle of change analysis. If threats are moving your way from other areas, you want to know about them—before they start involving your staff. The only way to accomplish this is to include the areas on the periphery of your own immediate working area in your analysis.
• Try to conduct the exercise on a large sheet of paper on the wall so everyone can see it and express their views. Cards, tape and “Post-It” sticky notes are ideal for listing the threats and placing them on the matrix, so that they can be repositioned easily if needed.
• When people begin to place the various threats on the matrix, they frequently change their determination of the likelihood or impact descriptors once they begin to think of them in relative terms on the matrix. This is not a problem, and should be encouraged, as long as the final assessment is reasonable and the stakeholders generally agree.
• Remember that the goal of the risk analysis step of the SRA process is to identify and clarify the threats that require your immediate attention. The risk matrix is first and foremost a managerial tool to help you visualize and prioritize the threats you are facing. Ultimately, your aim will be to manage each threat—either, make it less likely by moving it to the left on your matrix—and/or less “impactful” by moving it down on the matrix. How to do this will be the subject of the next module.
• Regular revisiting of the matrix and updating will help show you trends in the overall security environment and help you evaluate if you are really reducing or mitigating your risk in any significant ways.