Risk professionals know risk management involves measuring the likelihood and impact of risks. This information is used to create heat maps for organizations to determine the high-priority risks to control.
For each risk, the sources/causes and consequences are used to create a bowtie analysis. Adding more information like control measures, residual risk, Key Risk Indicators (KRIs), and corporate Risk Register data can make risk management feel overwhelming. Yet there is another variable some risk professionals tend to overlook.
Introducing risk velocity
Some risk experts are strong advocates of tracking “risk velocity” as a matter of principle. To understand risk velocity, let’s take a little lesson in physics. The definition of velocity is:
“A measure of the rate of motion of a body expressed as the rate of change of its position in a particular direction with time.”
To simplify further, velocity means how fast something is going over a particular distance and in a particular direction. In risk management, risk velocity indicates how quickly risk may affect an organization. As part of risk assessment, velocity can be measured qualitatively (high, medium, low) or quantitatively (hours, days, months, years, etc.). Here are a couple examples of high- and low-risk velocity:
Very High Risk Velocity: Chemicals are not stored in adequate conditions at a facility, resulting in an adverse chemical reaction. The consequences are almost immediate:
- Explosion,
- Fire
- Worker injury or fatality
- Immediate interruption of operations.
Very Low Risk Velocity: An aging workforce with critical subject matter expertise is expected to retire over the next 2-3 years. The consequences would be experienced in the long term:
- Loss of knowledge
- Loss of productivity
- Potential product quality issues.
Other low-velocity risks can lead to loss of market share and loss of reputation. Important to remember is reputational risks have accelerated in velocity in the era of social media and the 24-hour news cycle.
Evaluating risk velocity
Now that we have explained risk velocity, let’s look at various ways it can be evaluated. The easiest way is to factor risk velocity into the impact score. The more quickly the consequences or impacts are felt, the higher the score, and vice-versa. Other risk experts suggest including risk velocity in a well-defined formula used to evaluate risk scores. Here are two we found interesting:
- (Likelihood + Velocity) x Impact. This is from a post by Harry Hall published on the PM South blog. In this formula, the qualitative rating of risk velocity is given equal weight as the likelihood, and both are multiplied by the impact to produce the overall score.
- (Likelihood x Impact) + Velocity. This is mentioned in a guest post by Karel Simpson, Corporate Risk Manager at GardaWorld, on the Capable People blog. To understand this formula, let’s assume your heat map is a 5 x 5 matrix. If the likelihood and severity (or impact) of a risk are 4, your initial score would be 16. Using the following velocity rating scale where Hours to Days = 3, Days to Weeks = 2, and Weeks to Months = 1, you obtain impact scores of 19, 18, or 17.
To measure or not to measure?
Experts differ if risk velocity should be considered in enterprise risk management. Some are adamant risk velocity must be included while others stress organizational size and complexity must be considered before deciding. Those in the latter camp emphasize the importance of keeping risk management as simple as possible.
Regardless of your position, it is important to consider how quickly the impacts of risk will be felt by the organization. This will give you a better assessment of risk and help you prioritize mitigation efforts by determining the time you have to react.