Prioritizing risk with a risk matrix
Once auditors have identified the risks in their organization, how should these risks be documented and assessed? A risk assessment matrix is a common and highly useful documentation framework that supports risk management efforts, including:
- Identifying risks
- Assessing the likelihood and significance
- Red flags
- Preventative controls
- Detective controls
- Controls effectiveness assessment
- Residual risks
- Risk response
However, assessing the likelihood and significance of a risk occurring is a highly subjective process. Management and auditors should not only consider the monetary significance but also the importance to the organization’s reporting, operations, reputation, legal and regulatory compliance impact.
The risk matrix should be an active tool that both illustrates situational awareness and drives corrective action where needed. And while a risk matrix is often a very complex document, it doesn’t need to be. It may be effective to develop a risk matrix that ranks the likelihood of a risk event using subjective “seat of the pants” measures like probable, potential, possible, and remote classifications. Even broad measures like these can quickly demonstrate where action is needed right now.
It’s beneficial to take a step back, examine the risk matrix tools you’re using and ask yourself, “Is it too complex?” If the answer is “yes”, perhaps it’s time to make a change.
