Heat Maps and Risk Management

Heatmaps are commonly used as reporting and discussion tools in risk management. However, there are two different types/categories of heatmaps, only one of which is useful.

The useful heatmap

The below image is a useful heatmap, showing temperatures across an area or in the below case, the entire world. Note that colour codes are plentiful and linked to explicit quantitative scales. Furthermore, note that the image is based on actual data.

Such heatmaps are snapshots in time, but looking at series of these, you may be able to see trends which may be valuable for your decision making.

My problem is, that I have yet to hear about any one such map ever being used for active risk management of any sort. That is not to say it does not happen, just that it is probably not commonplace.

In the risk management world, a different type of heatmap is more commonly used.

The useless heatmap

The heatmap here is, on the other hand, utterly useless. Scales are undefined and hence subject to the interpretation of the viewer whereby five people will apply five different sets of scales. Colours are used, but holds no added information and “data” are based on biased human perceptions.

Instead of the shown numbers 1-5 many use qualitative descriptions such as “very low, low, medium, high, very high” or the like.

Any one risk is placed in one “cell” ignoring the fact that should the risk materialize, it may have any level of outcome, often not directly related to the likelihood. For instance, look at fire in a large organisation. A fire may be anything from an overheated coffee machine to a complete burnout of a facility. The former surely happens several times annually and still have very limited consequences (placing this in the upper left corner) whereas the latter is fortunately very rare, but costly (placing this in the lower right corner). What to do, what to do?

Still, the heatmap shows a couple of “red” risks to address. However, these may be deliberately and wisely taken risks to pursue strategic objectives. Furthermore, there is no way of telling how many “amber” risks it takes to be as serious as one “red” risk.

Research has shown that such heatmaps are useless on a good day, and downright dangerous on a bad day. See for instance https://onlinelibrary.wiley.com/doi/10.1111/j.1539-6924.2008.01030.x

The even moderately astute risk manager and risk consultancy know this, and know there are better ways to describe and prioritize risks. Those who do not know need to learn to earn their “license to operate” in risk management.

This means that when risk managers and risk consultants are advocating this type of heatmaps, they are committing what I would call professional misconduct.

My problem is, that this use of such risk heatmaps, or risk matrices is all too common in many companies, industries and even governmental institutions.

The way forward

I fully agree with Douglas Hubbard’s brilliant book “The Failure of Risk Management”. In my view, there is one way forward, and one way only. Leverage facts and science. This means:

Scope

Define which decision, target, aspiration you are risk managing. Without a target, there is no telling whether you eventually succeed or fail, and hence no base for risk management.

Do remember to manage good/positive risk as well as negative.

Likelihood

Define which time horizon you are addressing – eventually anything will happen. In some instances, this will be a frequency (e.g., these or those many times annually) in others cases it may be easier to determine the likelihood it will not happen and then subtract this from 1.

Impact

Measure risk impact in the metrics of your performance to link to decision or target.

Recognize that any risk may have an outcome range and define this based on the best facts/insights you have available – it may be subject matter expert viewpoints.

Management

Manage to optimize the likelihood of success (= meeting/exceeding targets) and refrain from being risk centric. Oddly enough, risk management is actually not about managing risks.

Report on the likelihood of meeting targets and related measures, e.g., likelihood of “disaster”, 10% worst case scenario, 10% best case scenario, … as well as most important risks to address if you wish to improve your likelihood.

Integrate risk management into the management and decision process you use already. There is neither need for, nor value in keeping risk management separate.

The above is NOT complicated, not even very cumbersome compared to the value created. Do this before your competitors outperform you and makes it “too late”.