Why a Risk Matrix Needs Diagnosis
A likelihood-impact matrix is useful for organizing discussion and highlighting scenarios for attention. It compresses judgments into categories, then often combines those categories into a score. That compression makes assessments easier to compare, but it also discards information. A high score is not automatically a precise estimate of expected loss, and a low score does not prove that a scenario is unimportant.
The key diagnostic question is not simply, “Which risk has the largest score?” Ask what information the score preserves, what assumptions produced it, and what it leaves out. Four limitations deserve particular attention: coarse category bands, ambiguous category definitions, arithmetic on ordinal ratings, and omitted dependencies between risks.
Coarse Categories Hide Differences
A category places a range of possible values into one band. Two scenarios in the same likelihood category may have very different probabilities, just as two impacts in the same band may differ substantially in severity. Conversely, two nearly identical estimates can fall on opposite sides of a category boundary and receive different ratings.
The consequence is that the matrix can suppress distinctions within bands and exaggerate small distinctions across bands. This does not make the categories useless. It means that category assignments should be read alongside the underlying estimates, their uncertainty, and the boundary rules.
Worked Example: A Category Boundary Changes the Ranking
A hypothetical insurer assesses one-year operational loss scenarios. For this illustration, each scenario either occurs once during the year or does not occur; conditional on occurring, its loss is fixed. Thus each loss is a Bernoulli occurrence indicator multiplied by a fixed severity. The likelihood scale is category 1 for probability at most 1%, category 2 for probability greater than 1% and at most 5%, and higher categories are not needed here. Impact category 3 means a loss from $150,000 to less than $300,000; category 5 means at least $600,000. The matrix score is likelihood category times impact category.
Scenario A has annual occurrence probability \(0.0090\) and conditional loss $900,000. Its likelihood is category 1, its impact is category 5, and its matrix score is \(1 \times 5=5\).
Scenario B has annual occurrence probability \(0.0490\) and conditional loss $150,000. Its likelihood is category 2, its impact is category 3, and its matrix score is \(2 \times 3=6\). The matrix therefore ranks B above A.
For comparison only, calculate expected annual loss under the stated Bernoulli-and-fixed-severity model. If \(I\) is 1 when the event occurs and 0 otherwise, then \(X=I L\), where \(L\) is the fixed loss conditional on occurrence. Since \(E[I]=p\), \(E[X]=E[I L]=L E[I]=pL\).
The calculation checks the ranking: B has the higher matrix score, while A has the higher expected loss by $750. The matrix ranking is not an expected-loss ranking. The point is not that expected loss must always determine priority; it is that the score alone cannot tell the reader which measure it represents.
A boundary check shows a second effect. If A’s probability estimate were \(0.0101\), with its severity unchanged, it would move from likelihood category 1 to category 2. Its score would become \(2 \times 5=10\), even though its expected loss would be \(0.0101(900{,}000)=\$9{,}090\), only $990 above the original estimate. A small probability change has caused a large score change because it crossed a band boundary.
Method and mistake avoided: Assign categories using the stated cutoffs, then compare the score with a separately calculated quantity only when a numerical probability and severity model are explicitly given. The common mistake is to interpret category numbers as if they were precise probabilities or monetary values.
Category Definitions Must Resolve Ambiguity
A label such as “major impact” is not a definition. Assessors need to know what impact dimension they are judging, the measurement period, the loss basis, and the thresholds between categories. For financial impact, for example, gross loss and net retained loss can place the same scenario in different bands. Other dimensions, such as customer harm, regulatory consequences, or service interruption, also need explicit treatment rather than an unstated personal interpretation.
Worked Example: Gross Versus Net Impact
A hypothetical organization uses three impact categories for one-year financial loss: category 1 is below $100,000, category 2 is from $100,000 to less than $250,000, and category 3 is at least $250,000. Both scenarios are assigned likelihood category 2. For illustration, assume each scenario has the same assessed likelihood category and use the matrix score \(L \times I\); no exact probability distribution is assumed.
Scenario X has a gross loss of $260,000 and a contractual insurance recovery of $200,000. If the assessor classifies gross loss, X is impact category 3 and its score is \(2 \times 3=6\). Scenario Y has a $220,000 loss with no recovery; it is impact category 2 and its score is \(2 \times 2=4\). On that basis, X ranks above Y.
If the intended impact measure is the organization’s retained loss, X’s net loss is \(260{,}000-200{,}000=\$60{,}000\). It is then category 1, with score \(2 \times 1=2\). Y remains at $220,000, category 2, with score \(2 \times 2=4\). On a net basis, Y ranks above X.
The arithmetic is consistent in both cases; the definition changed. Before comparing scores, the organization must specify whether impact is gross or net of recoveries and apply the same basis to every scenario. A recovery should also be included only if the assessment’s stated assumptions support it.
Method and mistake avoided: State the impact basis first, classify each scenario using that basis, and then calculate the score. The common mistake is to compare a gross-loss rating for one scenario with a net-loss rating for another as though they were comparable.
Where a matrix includes several impact dimensions, the method for combining them also matters. Taking the maximum category, adding categories, or selecting a single “primary” dimension can produce different results. The assessment should say which rule applies; otherwise, two assessors can follow the same table and still reach different ratings.
Ordinal Scores Are Not Automatically Quantitative
An ordinal scale indicates order: category 4 represents more likelihood or impact than category 3. It does not, by itself, say that the distance from 3 to 4 equals the distance from 1 to 2. Nor does category 4 necessarily represent twice the amount of likelihood or impact represented by category 2.
Multiplication is arithmetic on the category labels. It may provide a convenient convention for sorting or flagging scenarios, but it does not turn ordinal categories into measured quantities. In particular, a score of 8 cannot be interpreted as twice the risk of a score of 4 without a separate quantitative justification.
Worked Example: A Ranking Depends on the Category Codes
A hypothetical committee uses five ordered likelihood categories and five ordered impact categories. Two scenarios are rated as follows: R has likelihood category 2 and impact category 5; S has likelihood category 3 and impact category 3. The committee multiplies the category numbers.
Under the displayed codes, R scores \(2 \times 5=10\), while S scores \(3 \times 3=9\). The rule ranks R above S.
Now consider a different set of codes that preserves the order of the likelihood categories: replace the likelihood labels \(1,2,3,4,5\) by \(1,2,10,11,12\). Keep the impact codes unchanged. These new likelihood codes are still strictly increasing, so the order of likelihood categories has not changed. R’s score remains \(2 \times 5=10\), but S’s score becomes \(10 \times 3=30\). The ranking reverses.
This is not a proposal to use the alternative coding. It demonstrates that multiplying ordinal labels does not give a ranking that is invariant to order-preserving recoding. If a score is intended to support a quantitative interpretation, its scales and combination rule need an appropriate quantitative basis; the ordinal labels alone do not provide one.
Method and mistake avoided: Separate a score’s role as a sorting convention from a claim that it measures the amount of risk. The common mistake is to infer meaningful ratios or distances from the category numbers merely because they can be multiplied.
Separate Ratings Can Omit Dependence
A matrix often assesses scenarios one at a time. That can conceal whether losses occur together, whether one event triggers another, or whether both depend on a common cause. This matters when considering combined outcomes: even if each scenario’s individual rating is accurate, the chance and size of a joint loss depend on the relationship between scenarios.
Worked Example: Two Losses With Different Dependence
A hypothetical service provider assesses two disruption events, each with probability \(0.1000\) over one year. If an event occurs, it causes a fixed loss of $100,000; otherwise its loss is zero. Let \(X_1\) and \(X_2\) denote the losses. Compare two possible dependence assumptions: first, the events are independent; second, they always occur together. The individual likelihood and impact ratings are the same under both assumptions.
Under independence, the probability that neither event occurs is \(0.9 \times 0.9=0.81\). The probability that only event 1 occurs is \(0.1 \times 0.9=0.09\); only event 2 also has probability \(0.09\). The probability both occur is \(0.1 \times 0.1=0.01\). These probabilities sum to \(0.81+0.09+0.09+0.01=1.00\).
The combined loss is zero if neither occurs, $100,000 if exactly one occurs, and $200,000 if both occur. Therefore, under independence, the probability of a combined loss of at least $200,000 is \(0.0100\), and the probability of any loss is \(0.09+0.09+0.01=0.1900\).
If the events always occur together, the combined loss is $200,000 with probability \(0.1000\) and zero with probability \(0.9000\). The probability of a combined loss of at least $200,000 is now \(0.1000\), not \(0.0100\); the probability of any loss is \(0.1000\), not \(0.1900\).
Both assumptions have the same individual event probabilities and fixed severities, but the probability of the joint $200,000 loss differs by a factor of ten. The matrix entries considered separately do not reveal this difference. A shared cause or a plausible mechanism linking the events should therefore be recorded and considered when assessing combined exposure.
Method and mistake avoided: Specify the joint assumption before calculating combined probabilities, and list the possible joint outcomes. The common mistake is to assume independence simply because two risks have separate entries in a register.
How to Use a Matrix Without Overstating It
A matrix can support structured discussion and triage, but its outputs need context. A useful diagnostic review asks whether the categories have clear definitions, whether close calls near thresholds have been identified, whether assessors are using a consistent impact basis, and whether plausible common causes or interactions have been considered. When evidence is limited, note that uncertainty instead of implying that the category is precise.
Confirm the time horizon, category thresholds, impact dimensions, and treatment of recoveries or other mitigations.
Record estimates or explanations that distinguish scenarios in the same band, and flag assessments close to a cutoff.
Use a multiplied score as a prioritization convention unless a quantitative model supports a stronger interpretation.
Ask whether a common cause, sequence, or other dependence could make losses occur together.
These checks help prevent a tidy-looking matrix from being mistaken for a complete measurement of risk. The objective is not to discard qualitative assessment, but to make its limits visible so that rankings are interpreted appropriately. This diagnostic treatment is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
Check Your Understanding
For each problem, distinguish what the matrix establishes from what would require additional assumptions or data.
- A one-year event has probability \(0.0080\) and a fixed loss of $500,000 if it occurs. The likelihood scale assigns category 1 to probabilities at most 1%, and the impact scale assigns category 4 to losses from $400,000 to less than $700,000. With a product score, what is the score and the expected loss under the stated model? (Answer: Score \(1 \times 4=4\); expected loss \(0.0080 \times \$500{,}000=\$4{,}000\).)
- A matrix defines category 2 impact as $50,000 to less than $200,000 and category 3 as at least $200,000. One assessor uses gross loss of $210,000; another uses net retained loss of $90,000 after a stated $120,000 recovery. What are the two category assignments, and what must be clarified for a valid comparison? (Answer: Gross basis: category 3; net basis: category 2. The impact basis must be consistent and explicit.)
- Two scenarios have category pairs \((1,5)\) and \((2,2)\). Using the product rule, calculate both scores. What can and cannot be inferred from the numerical ratio of the scores? (Answer: Scores 5 and 4. The first score is numerically 1.25 times the second, but that does not establish that its risk is 1.25 times as large.)
- Two events each have probability \(0.2000\). Under independence, what is the probability both occur? Under perfect positive dependence, where they always occur together, what is that probability? (Answer: Independence: \(0.2000 \times 0.2000=0.0400\); perfect positive dependence: \(0.2000\).)
- Two independent events each cause a fixed loss of $50,000 when they occur, and each has probability \(0.1000\). What is the probability of any loss and the probability that the total loss is $100,000? (Answer: Probability of any loss \(=1-(0.9)(0.9)=0.1900\); probability of a $100,000 total loss \(=(0.1)(0.1)=0.0100\).)