Forecasting is the key to any businessperson’s ability to weather “risk” storms. Yet even seasoned risk professionals sometimes lose sight of the importance of looking to the future. All too often risk managers fall into the trap of relying only on analyses of past behavior to make assumptions about future behavior. Sometimes, however, the only way to predict the future is to stare straight into it, rather than turning our heads to the past.

When forecasting risks, you need to understand and try to gauge the following four essential characteristics:

In this chapter and Chapter 10, you will be introduced to some specific measures and analytic approaches for forecasting risks. By the end of these chapters you will have learned about the basic forecasting tools and how to combine these measures with a broader set of risk management information to create your company’s total risk profile.

The most basic forecasting tool is the risk matrix. Regardless of your current level of sophistication when it comes to risk management, you can use the risk matrix to create a visual representation of relative risks.

To create a risk matrix, rate each of your risks with respect to its likelihood. Then rate each again with respect to its relative consequences or severity. Once you have done that, you can plot them on a matrix of likelihood versus consequence, as shown in the following illustration.

Risks with both high likelihood and high consequence (or severity) are high risk. Conversely, risks with low likelihood and low consequence are considered relatively low risk. The risk matrix provides a means of seeing the risks relative to one another for the sake of comparison.

A risk matrix gives you a quick visual snapshot of your risks, the likelihood of each, and the level of severity of each.

The risk matrix can take on any level of sophistication, from very simple qualitative assessments to highly quantitative rankings on each axis. Start simply by using the risk matrix to sum up the varying risks you face.

Risk tables are another type of forecasting tool in the risk manager’s toolbox. There are actually two types of risk tables, the risk likelihood table and the consequence table. Both types of tables offer a nice way to better understand and predict the risks. The consequence table also helps to forecast or describe the ultimate outcome (or severity) of a risk event.

The risk likelihood table, or matrix, helps to forecast or describe the potential likelihood (or probability) of a risk event occurring.

The risk consequences table, or matrix, shows the types and scales of consequences and how severe they can be to your company.

Using the consequence table as an example, start by setting up a scoring method for the risks. Rate the likelihood of a risk from, say, 1 to 5, with 1 being low and 5 being high. This score should encompass a minimum of 3 categories, although it works best with 8 to 15 categories. Assign each category a qualitative rating, a quantitative rating, or a combined rating of the likelihood of a risk materializing.

The simplest forms of this table seek a consensus with regard to any particular ranking. For instance, if you put five people into a room, the descriptions in the table would allow them to easily agree that any specific risk carries the same ranking. More advanced forms use a scoring method to “add up” and weight characteristics that contribute to severity to arrive at a ranking.

The translation of these tables is fairly straightforward. When you tell someone within your company that you are addressing a 1A risk, they will come to understand that you mean you are addressing a low-probability, low-severity situation.