Appendix C

Common Risk Management Model

A risk management model from the IRMF

Many variations of this risk management model are in use, including matrices expanded by adding rows or columns for "very high" or "very low." Descriptions of impact and likelihood along the two axes may vary, as may descriptions in particular cells, depending on the context and requirements of the organization using the model. Some versions incorporate references to the organization's decision-making structure, e.g. the shaded cells may include the level of authority required or the rank of the person responsible for managing the particular risk. This facilitates assessment of where a particular risk falls in terms of likelihood and impact and helps establish the organizational response to manage the risk.

Other options for displaying key risks in relation to each other on a single page include risk maps for the whole organization or for a business line or program.

The model can also be used for assessing ideas in the context of opportunity seeking and innovation or experimentation—the thought being that an organization wants to make investments appropriate to the likely return on those investments. In this context, impact and likelihood could be considered by asking questions such as:

• What could this idea be worth if it works?
• How likely is this idea to work?
• What will it take to achieve this?