Guidelines for Designing Risk Matrices

Paul Baybutt
Primatech Inc, Columbus, OH; [email protected] (for correspondence)
Published online 7 July 2017 in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/prs.11905

Risk matrices are used widely in process safety to rate and graphically appealing. However, there are no industry or
rank risks posed by processes to help with decision making. government standards for risk matrices for process safety.
For example, commonly they are used in process hazard Consequently, risk matrices are constructed intuitively but
analysis to rate the risks of hazard scenarios and determine arbitrarily by companies.
the need for risk reduction. However, there are no standards On the face of it, risk matrices appear to provide a valid
for risk matrices in process safety. Companies develop their basis for comparing the risks of different events. However,
own without the benefit of established industry guidelines. there is little empirical evidence to show that risk matrices
Risk matrices are deceptively simple but their design and use produce valid estimates of risk or good risk decisions.
are rife with pitfalls, even for experienced users. Some of Largely, practitioners make these assumptions and do not
these pitfalls are not obvious and invalid risk ratings can question whether the validity of using risk matrices has been
result which are unrecognized. Guidelines for constructing proven. Unfortunately, risk matrices often are flawed in vari-
risk matrices that address these pitfalls are provided. V C 2017 ous ways, possibly because their development appears to be
American Institute of Chemical Engineers Process Saf Prog 37: 49–55, deceptively simple but is actually more complicated than it
2018 seems. Flaws in the underlying theoretical framework of risk
Keywords: risk matrix; risk ranking; process hazard anal- matrices have been identified [5,6]. Poorly designed risk
ysis; process safety matrices make the process of risk rating difficult and produce
risk ratings ill-suited for decision making. Literally, the rec-
INTRODUCTION ommendations made by PHA and similar studies may be
Risk matrices provide a simple means of rating and rank- incorrect.
ing the risks of events. They are used for decision making in Little attention has been paid in the literature to the devel-
many areas to allocate resources appropriately to address opment of risk matrices in process safety. Guidelines for haz-
risks. Indeed, risk matrices are used by many companies for ard evaluation procedures from the Center for Chemical
their risk-based decisions. In process safety, they are used to Process Safety (CCPS) provide two examples of risk matrices
estimate the risks of events such as hazard scenarios. In par- and briefly describe their use in PHA studies [7]. However,
ticular, they have become a key aspect of performing pro- the CCPS guidelines do not address the construction of risk
cess hazard analysis (PHA) to risk rank individual hazard matrices. This article provides such guidelines.
scenarios to help determine the need for risk reduction and
to set priorities for risk reduction measures [1]. RISK MATRICES AND RISK RATING
Risk matrices must be designed appropriately because In risk rating, subjective estimates of consequence severity
critical decisions on the need for recommendations to reduce and likelihood values for an event such as a hazard scenario
risk are predicated on their risk ratings. Flawed ratings trans- are assigned to levels corresponding to values or ranges of
late to poor decisions and mis-managed process risks. In values of severities and likelihoods for each type of conse-
PHA, the results of an otherwise well-performed study may quence, such as impacts on facility personnel, members of
be invalidated by use of poorly designed risk matrices. This the public, process equipment, on-site and off-site property,
issue is important for any risk analysis method that employs and the environment (see Tables 1 and 2). A risk level is
risk matrices. determined for the event by lookup of the assigned severity
The international standard on Risk Management Vocabu- and likelihood levels in a risk matrix, grid, or table that dis-
lary, ISO 73:2009, defines the term risk matrix [2] although plays risk levels (see Figure 1). Risk levels correspond to
the international standard on Risk Management, ISO cells in the risk matrix. The risk ratings obtained are for indi-
31000:2009 does not specifically address the use of risk vidual events such as single hazard scenarios.
matrices [3]. However, the international standard, IEC/ISO Risk matrices are used for multiple purposes including:
31010, Risk Management—Risk Assessment Techniques, pro-
vides a description of the consequence/probability matrix,  Determining if further risk reduction is needed
that is, risk matrix, in an Annex on risk assessment techni-  Resolving differences of opinion on the need for recom-
ques [4]. The standard notes, “it is important that an appro- mendations to reduce risk
priate design is used for the circumstances.”  Deciding on alternative recommendations for risk reduction
Use of risk matrices finds favor because they appear to be  Prioritizing the order of risk reduction recommendations
simple to understand, provide a clear rationale for risk esti-  Specifying the type of risk reduction action required
mates, do not require specialized expertise, and are  Determining how quickly risk reduction actions should be
implemented
 Screening events or scenarios for more detailed analysis
C 2017 American Institute of Chemical Engineers
V  Highlighting high risk events for further study

Process Safety Progress (Vol.37, No.1) March 2018 49

Table 1. Example of severity levels for various consequence types.

Business
Severity Level Safety Environmental Property Damage Interruption Public Relations
1 – None/ None None None None None
Insignificant
2 – Low 1 fatality Localized cleanup Minor ( $100,000)  1 day Queries to plant only
only
3 – Medium  10 fatalities Exceed permit Moderate ( $1MM)  10 days Complaints from
conditions neighbors
4 – High  100 fatalities Observable effects Major ( $10MM)  30 days Local media attention
on flora and fauna
5 – Very high  1,000 fatalities Remediation Extensive ( $100MM)  60 days National media attention
required

SEVERITY The types of casualty of concern also must be identified.

For people, for example, fatalities should always be add-
1 2 3 4 5
ressed of course but it must be decided whether lesser casu-
alty types, such as permanent disabilities, hospitalizations,
1 1 2 3 4 5 lost time injuries, and first aid cases, also should be included.
Most practitioners include at least the more severe nonfatality
LIKELIHOOD

2 2 4 6 8 10 casualty types.

3 3 6 9 12 15 Range of Scenario Severities and Likelihoods

to Be Addressed
A risk matrix must cover the overall ranges of conse-
4 4 8 12 16 20 quence severities and likelihoods that may be encountered
and used in all studies that will use the risk matrix. Conse-
5 5 10 15 20 25 quence severities may range from the minor to the cata-
strophic and likelihoods may range from likely to extremely
Figure 1. Example of a Risk Grid. unlikely. The endpoints of the overall ranges of severities
and likelihoods must be defined.
Usually, PHA studies capture any scenario that is viewed
as feasible and credible, however unlikely it may be. This
 Complying with government regulations and industry practice recognizes that a principal concern is with rare cata-
standards strophic scenarios which, by their nature, are of very low
likelihood and very high consequence. Scenarios that are
Usually, a set of risk matrices is needed for process safety
viewed as infeasible or incredible usually are not recorded.
studies. The set, together with the definitions for each matrix,
Thus, a risk matrix must include the worst feasible conse-
is denoted as a risk rating scheme herein.
quence (highest severity) that could occur and the lowest
credible likelihood at which an adverse consequence may
GUIDELINES FOR DEVELOPING RISK MATRICES
occur. Note that although rare catastrophic events are not
The confidence practitioners place in a risk rating scheme
expected to occur at a frequency within the typical lifetime
that uses risk matrices and their willingness to take it seri-
of a process, that does not mean a process will not experi-
ously depend on its validity so the following issues should
ence one.
be addressed carefully. Clearly, the meanings of “feasible” and “credible” are vital
to establishing a rating scheme. “Feasible,” as applied to a con-
Consequence and Casualty Types to Be Addressed sequence severity, means the consequence severity is possible.
Typically, multiple types of consequences are of concern Thus, if there are only 100 people who work in a facility, a
in process safety, for example, impacts on employees, the consequence that impacts more than 100 people on-site is
public, and the environment. In PHA studies, the conse- infeasible, that is, it is not possible. “Credible” may mean dif-
quence types required in a risk rating scheme will be dic- ferent things to different people. The dictionary definition is
tated by the purpose, scope, and objectives of a study [8]. “able to be believed.” In PHA, it means the scenario likelihood
Some practitioners place employees and members of the is believed to be at or above a threshold value, for example, a
public in the same category. However, separate categories frequency of occurrence of 1 3 1026 per year. Note that
should be used because the tolerability of risks for employ- “incredible” does not mean an event absolutely cannot happen
ees, who accept risks voluntarily, usually is higher than for but rather it occurs with a likelihood that is sufficiently low
members of the public, who do not. Regulators, such as the that it can be excluded from consideration.
United Kingdom Health and Safety Executive, have sug- For severities, the lowest value can be set at the level of
gested lower tolerable risk criteria for the public than for minimal concern, even though few events or scenarios may
facility personnel [9]. Companies also may be concerned pose such impacts in process safety studies. The inclusion of
about impacts such as the costs of operability impairment, this level provides a lower bound that ensures any such sce-
process downtime, property damage (on-site and/or off-site), narios that exist can be risk rated, for example, first-aid cases
cleanup and accident response, regulatory and legal actions, for people. The highest value for severity should be the larg-
and damage to their public image. est impact feasible, for example, hundreds or possibly

50 March 2018 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.37, No.1)
Table 2. Example of likelihood levels.

Definition Meaning (Number

Likelihood Level (Frequency Per Year) of Occurrences) Guidance
9 – Very high  10 Up to 10 times per year Frequent occurrence
8 – High  1 Up to once per year Common occurrence
7 – Medium  1E-1 Up to once every 10 years Occasional occurrence
6 – Low  1E-2 Up to once every 100 years Event may be observed but not
expected
5 – Very low  1E-3 Up to once every 1000 years Unlikely the event will be observed
but has occurred somewhere
4 – Exceptionally low  1E-4 Up to once every 10,000 years Highly unlikely the event will be
observed. Never been observed.
3 – Extremely low  1E-5 Up to once every 100,000 years Extremely unlikely the event will be
observed
2 – Barely possible  1E-6 Up to once in a million years Just conceivable the event may be
observed
1 – Insignificant Negligible likelihood Effectively never No one believes the event would
ever be observed

thousands of fatalities for impacts on people. The accident in performed on all of them using the same risk rating scheme
Bhopal, India certainly is a candidate for the worst-ever acci- for consistency.
dent in the process industries and thousands of people were Practitioners may identify scenarios which they believe
killed [10]. Worst-case feasible severities must be included for are not credible or for which they believe there are no
each consequence type in the risk rating scheme. impacts. To avoid the inappropriate assignment of such sce-
For likelihoods, the highest value usually starts with once narios to the lowest likelihood and severity levels, or their
per year for process safety applications because even events omission from a study, it is advisable to use lower bounds of
of the least severity considered in process safety would most “not credible” for likelihood and “no impacts” for severity.
likely not be tolerated if they occurred at a greater fre- This practice is advisable because it is possible that, on
quency. Put another way, the highest likelihood value review, the assignments may be changed, or that future pro-
should be tolerable for the lowest severity value. For the cess changes may result in reassignments.
lowest likelihood, the lowest credible value is used, for Some practitioners use severity levels of “single fatality”
example, 1 3 1026 per year. and “multiple fatalities.” Such practice is problematic. The
In using risk matrices, often practitioners assume all safe- problem is that there is no way of discriminating between
guards fail when estimating the severities and likelihoods of events or scenarios that fall into the multiple fatalities level.
scenarios. This assumption means that severities will be They may involve anywhere from a few fatalities to tens or
higher and likelihoods lower than would otherwise be the hundreds or more fatalities, if such scenarios prove possible.
case. These values should be taken into account when set- Thus, an event or scenario such as the Bhopal accident that
ting ranges. arguably killed up to 8,000 people and permanently injured
The upper and lower bounds for severities and likeli- 100,000 people [10] would be assigned to the same severity
hoods should provide bookends for the assignment of sce- level as one that impacted a much smaller number of
nario values by practitioners. If practitioners find a scenario people.
for which they believe the severity or likelihood falls outside An upper severity limit that exceeds, for example, 10 or
the overall range, the risk rating scheme is most likely inade- 20 on-site fatalities may not be considered feasible by pro-
quate and does not meet the needs of the study. For exam- cess safety practitioners, even if such scenarios are actually
ple, the upper bound for impacts on people off-site may possible. Certainly, a number of well-known accidents in
have been set at 100 fatalities in the belief (or hope) that this recent years have resulted in numbers of fatalities within that
is the maximum consequence possible. However, if a study range and a few accidents have occurred that resulted in
team identifies a scenario that could result in many more thousands of fatalities. Many analysts may not want to con-
fatalities, the risk rating scheme will not accommodate it. sider the prospect of scenarios that could result in hundreds
Upper and lower bounds for severities and likelihoods that or thousands of fatalities, perhaps in the mistaken belief that
are outside the expected range may be included in risk rat- they are not possible or because they do not want to con-
ing schemes in anticipation of such situations. template such a catastrophic consequence. In this case, some
Thus, the range of needed severity values may cover a companies allocate all such scenarios to the highest severity
span greater than will apply to the majority of scenarios in level and subsequently perform more detailed consequence
PHA. For example, in a facility that employs 1,000 people, it modeling studies to produce a better determination of sce-
is conceivable that one or more scenarios exist that could nario consequences.
cause the fatality of all employees. Thus, a severity level that
encompasses this number of fatalities should be included in Number of Severity and Likelihood Levels
the risk rating scheme for the facility, even though few if any Scenario severities and likelihoods are defined as levels or
scenarios are expected to be assigned to the level. The categories, typically, using numbers, or letters. Each level or
objective in defining the overall ranges for severity and likeli- category represents a value, or part of the range of values, of
hood values is to include any values that could possibly be severity, or likelihood.
encountered. This objective is particularly important when The number of severity and likelihood levels should be
multiple processes exist at a site and PHA studies are to be consistent with the ability of practitioners to discriminate

Process Safety Progress (Vol.37, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2018 51
between levels. For example, a 3 3 3 scheme is common in elaborate ones impede the process of risk rating and likely
simple risk analysis (high, medium, and low values are used do not improve the results. Specific examples to illustrate the
for severity and likelihood). However, the principal concern meaning of severity and likelihood levels for events can pro-
in process safety is with catastrophic accidents. All such rare vide useful reference points for practitioners, for example, to
event scenarios would likely be rated as high severity—low illustrate likelihood levels:
likelihood in the three-level scheme, thus, providing no risk
discrimination between them. Such a situation is not very Level 1—Not expected to occur during the process life-
useful for decision making on risk reduction measures. Risk time: Simultaneous failures of two or more independent
matrices that effectively force many scenarios into one risk pieces of equipment.
Level 2—Expected to occur only a few times during the
level should be avoided. More levels of severity and likeli-
process lifetime: Piping rupture.
hood are needed so that scenarios can be differentiated.
Level 3—Expected to occur multiple times during the life
Enough levels must be used to provide sufficient discrimina-
of the process: Transfer hose rupture, pipe leaks, pump seal
tion across the spectrum of possible values.
failure.
However, risk rating is a subjective process that has its
Level 4—Expected to occur annually: Instrument compo-
limits [11]. There are significant uncertainties involved and
nent failures, valve failures, transfer hose leaks.
the level of discrimination must be commensurate with what
is practical, particularly when risk rating is performed in the To accommodate logical versus intuitive thinking by ana-
context of PHA which is intended as a qualitative analysis. lysts, some practitioners express severity and likelihood defi-
Large numbers of levels should be avoided because they nitions in both numerical and narrative terms (see Table 2
require more discrimination than can be accomplished by a for an example). This practice may be particularly beneficial
PHA team. Too many levels will leave practitioners in a for likelihoods because people have difficulty relating to
quandary regarding which level to assign when several seem very low numerical values.
possible. There should be no overlap in the endpoints of the
A decision on the number of severity or likelihood levels ranges for severity or likelihood levels to avoid ambiguity in
entails deciding how their overall ranges of values will be the assignment of values to levels. Definitions of severity and
partitioned. Usually, the ranges are wide and span orders of likelihood levels must not be too close, otherwise analysts
magnitude in process safety. Consequently, adjacent severity will not be able to decide which level to assign. For exam-
and likelihood levels often are chosen to differ by an order ple, PHA team members may have difficulty distinguishing
of magnitude. Such a choice makes it easier for analysts to scenarios that have 3 fatalities from ones that have only 1 or
discriminate between levels and provides consistent risk lev- 2 fatalities.
els that also differ by orders of magnitude. The number of The ranges of severity and likelihood covered by each
severity and likelihood levels is determined when overall level should not be too large as this may force difficult
ranges are specified and the ranges to be covered by each choices between adjacent levels. For example, if two adja-
level are defined. cent severity levels cover the ranges 1 to 99 and 100 to 999,
Commonly, schemes in which the number of severity lev- and the number of fatalities is estimated to be around 100,
els is the same as the number of likelihood levels are used. plus or minus, the choice of level is problematic because
This produces a symmetric risk matrix. However, different assignment to the second level may be overly conservative.
numbers of levels can be used producing an asymmetric Such a rating scheme may bias the choice if the decision
matrix. guidance for one selection is more onerous than another.
Often, risk rating schemes use the same number of sever- Analysts may feel justified in making the selection that pro-
ity levels for each type of consequence but, of course, each duces the less onerous result since they are conflicted as to
level for each type of consequence has its own definition which level is the appropriate one. The narrowest ranges
(see Table 1). Usually the same number of likelihoods and a that permit discrimination between levels should be used.
single set of likelihood definitions is used for all conse- It is useful to provide a likelihood level that denotes an
quence types (see Table 2). Different numbers of likelihoods event or scenario is not credible so as to avoid the pro-
and definitions could be used but at the expense of making longed discussion by analysts that may otherwise occur. Sim-
risk rating more complicated. ilarly, it is useful to provide a severity level for which there
is no adverse impact.
Definitions of Severity and Likelihood Levels Risk matrices sometimes define severity and likelihood
Severity and likelihood levels defined in purely qualitative levels as point values. Of course, the events and scenarios
terms such as “high,” “medium,” and “low” are of little value that they are used to rate may not correspond exactly to
in process safety other than for rough screening or possibly these values. For conservatism and pragmatism, such point
for ranking risks within an individual project. Such schemes values are best interpreted as upper bounds. For example,
are open to widely different assignments of severity and like- two adjacent likelihood levels in a risk rating scheme may be
lihood by team members owing to the subjectivity involved defined as frequencies of once every 10 years and once
in assigning levels. Consequently, companies typically pro- every 100 years and two adjacent severity levels may be
vide definitions for each of the severity and likelihood levels defined as 1 fatality and 10 fatalities. Thus, the likelihood
in more meaningful terms. Usually, the levels are described level defined as once every 10 years is interpreted to mean a
more quantitatively. This does not mean that a quantitative value in the range of greater than once every 100 years up
analysis is being performed; rather the definitions are used to once every 10 years and a severity level defined as 10
to guide the assignment of levels by the analysts. fatalities is interpreted to mean a value in the range of more
Definitions of levels should be kept simple and must be than 1 fatality up to 10 fatalities. Severity and likelihood lev-
understandable by typical team members. Any qualitative els are best defined in terms of “up to” a defined value rather
terms should be clarified, for example, the meaning of than a defined value of “or more.”
“severe injury.” When frequencies are used, the units should Some practitioners view such assignments as producing
be specified. results that may be too conservative when severity and likeli-
Some practitioners have developed rules to guide the hood levels differ by orders of magnitude. Intermediate lev-
assignment of levels. Simple rules may be useful but els can be used, such as a level that corresponds to 5

52 March 2018 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.37, No.1)
fatalities or a frequency of once every 5 years. However, as defined in monetary terms. This inference can create difficul-
successively greater precision is sought, the problem persists. ties. Some people object to the concept of placing a value
Also, while a PHA team may be able to offer an informed on human life, even though there are many precedents.
opinion on the number of possible fatalities for a scenario in Other people may debate the value that should be used.
the range from 1 to 10, or the likelihood of a scenario in the The more consequence types that are included in the risk
range of once per year to once every 10 years, much greater rating scheme, the more difficult it becomes to equate
difficulty will be experienced for levels with a higher number impacts at the same severity level for the different conse-
of fatalities and lower likelihoods. Indeed, the use of levels quence types. Possibly the only way this can be achieved is
that differ by orders of magnitude reflects uncertainties that to reduce all impacts to monetary terms and adjust the
exist when estimating increasingly higher severities and assignment of impacts to severity levels accordingly. How-
lower likelihoods. ever, that is not easily accomplished.
Some practitioners subdivide order of magnitude ranges
into several smaller ranges for lower severities and higher Decision Requirements to Be Used
likelihoods for which estimates with greater precision are Decision requirements are associated with risk levels in a
achievable by practitioners. However, these scenarios occupy risk matrix. They specify the actions required for events or
a very small part of risk space and such discrimination is not scenarios that fall into each risk level. Typically, the require-
always useful for process safety purposes where rare events ments specify the amount of risk reduction needed and/or
(high severity and low likelihood) are the scenarios of major the type of action needed for risk reduction. Some practi-
concern. tioners specify the number of independent protection layers
Analysts tend to think of severity and likelihood values in required. Also, priorities, time periods for actions to be com-
linear terms as the levels are frequently defined using cardi- pleted, and the level of management attention required may
nal numbers. However, such levels actually represent severi- be defined for each risk level. Companies must decide on
ties and likelihoods in logarithmic space when the levels the decision requirements to be incorporated into their risk
differ by orders of magnitude. Thus, if scenario likelihoods rating schemes so that suitable risk levels can be defined.
ranging from once per year to once every thousand years Examples of decision requirements are:
were represented linearly, and the defined value for each
level represents the upper limit for that level, the levels rep- 1. Risk intolerable. Must be mitigated immediately to risk
resenting once per year, once every 10 years, once every 100 level 2 and if that cannot be accomplished, the process
years and once every 1000 years occupy 0.001, 0.009, 0.09, must be shut down.
and 0.9% of the likelihood space. A similar situation applies 2. Risk undesirable. Must be mitigated within 2 months to at
to consequence severities that differ by orders of magnitude. least risk level 3.
Thus, scenarios that are assigned to high severity and low 3. Risk tolerable with controls (engineering and administrative).
likelihood levels (i.e., rare events) unfortunately have the 4. Risk minimal. No further action required
most uncertain risks in such risk rating schemes. These
uncertainties are inherent for rare events and the pursuit of Of course, decision requirements for risk levels must cor-
greater precision in risk rating such scenarios is not possible. relate with the risks posed. Decision requirements usually
As severities increase and likelihoods decrease, the corre- vary according to the type of consequence and the type of
sponding part of risk space increases exponentially when casualty. The decision requirements and framework of the
levels differ by orders of magnitude, as is common practice. As Low As Reasonably Practicable (ALARP) principle are
The risk matrix cell with the highest severity and lowest like- being used increasingly [12].
lihood covers the largest part of the risk space. Decision requirements based on risk rating must be work-
When severity and likelihood level ranges that otherwise able. For example, high severity scenarios in PHA often are
would cover an order of magnitude are subdivided into two assigned the lowest likelihood value, usually on the basis
ranges, a midpoint severity or likelihood value is sometimes that many existing safeguards would need to fail. Thus, if the
defined by calculating the logarithmic midpoint of the range decision requirement for such scenarios is other than “no
and taking its antilogarithm. Thus, for the severity range of 1 action needed,” nothing can be done to achieve tolerable
to 10 fatalities, a (rounded) value of 3 fatalities is used (100.5) risk as the addition of a safeguard will only decrease the
which is the midpoint between the two severity values on a likelihood since PHA assumes all safeguards fail and, there-
logarithmic scale. fore, no credit is taken for consequence severity mitigation
Some practitioners provide definitions of different types unless credit is taken for certain safeguards, such as passive
of casualties within the same severity levels, for example, ones. However, crediting any safeguards in this way may
when a severity level is defined as one fatality or 10 severe violate regulatory requirements in some jurisdictions. Thus,
injuries. Such practice is problematic. It interferes with the risk matrices should contain a lowest likelihood level for the
consideration of both individual and group risk to people. highest severity level such that the corresponding risk level
Furthermore, analysts may not agree with the implied equiv- does not require any further risk reduction.
alences, particularly if they are not maintained in other sever- Decision guidance must be appropriate to the underlying
ity levels. Also, the maximum number of casualties for a risks. It must be viewed as reasonable in the eyes of the
facility varies by casualty type so that while one on-site fatal- practitioners whose confidence in their work may otherwise
ity may be equated to ten on-site severe injuries, it makes no be undermined. For example, decision guidance for the
sense to equate 100 on-site fatalities to 1,000 on-site injuries highest risk level that allows continued operation of a pro-
for a facility that employees only 100 people. cess rather than requiring immediate action to reduce risk
The use of the same severity levels for different conse- will be viewed with skepticism at best, particularly if the
quence types may or may not imply equivalent impacts for highest risk level involves multiple fatalities per year. In such
the same level (see Table 1). If the impacts are intended to situations, most companies would not question the need to
be equivalent, risk ratings can be compared across conse- shut down the process immediately until remedial action
quence types. Otherwise, such risk comparisons are not could be taken. Furthermore, decision guidance should be
meaningful. If the impacts are intended to be equivalent, the considered from the perspective of public reaction if it were
value being placed on a human life can be inferred from the disclosed, and the ability to justify it in any litigation that
risk matrix when the impacts of other consequence types are may result from accidents in processes where it was used.

Process Safety Progress (Vol.37, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2018 53
 Decision requirements also must be reasonably achievable such as toxic exposure versus fire exposure. People may fear
for the processes where they will apply. There is little point one more than the other.
in requiring risk reduction actions that are infeasible, imprac- Different risk levels should not share the same underlying
tical or nonsensical. Decision requirements also may be risk values. Risk matrices can be designed to minimize this
structured differently for existing processes versus new pro- problem and, in particular, avoid risk ranking reversals [14].
cesses and for different types of processes. For example, If the same number of severity, likelihood and risk levels
reduction within a specified time period for a specified risk are defined for each consequence type, in principle, the
level is often used for existing processes while risk reduction same risk matrix can be used for all consequence types.
before the next stage of design may be used for new pro- However, companies may wish to vary decision guidance
cesses. Similarly, decision requirements for continuous pro- from one consequence type to another for the same risk
cesses operating with turnaround periods of several years level. In such cases, decision guidance can be defined for
are likely to be different than those for batch processes. each consequence type for each risk level allowing the same
matrix to be used. In other cases, separate risk matrices may
Number of Risk Levels be used for each consequence type, each with its own deci-
Each combination of severity and likelihood levels is sion guidance.
assigned to a risk level. A sufficient number of risk levels
must be defined to provide discrimination for decision mak- Calibration of Risk Matrices
ing. A minimum of three levels should be used to cover the The assignment of decision requirements to risk levels must
decision requirements of action required, action desirable, reflect a company’s risk tolerance criteria. For example, if the
and action not needed. However, more levels are desirable numerical tolerable risk for a single fatality per scenario is 1 3
to provide additional options for decision making. Adjacent 1026 per year, the risk level corresponding to a severity level
risk levels must provide sufficient risk discrimination to per- of a single fatality and a likelihood level of 1 3 1026 per year
mit meaningful differences in the decision requirements for would be assigned a decision requirement of no further action
the risk levels, recognizing the uncertainties in the severities needed. Risk matrices must be calibrated according to a com-
and likelihoods used in their estimation. pany’s risk tolerance criteria through the appropriate assign-
Each combination of severity level and likelihood level ment of decision requirements to risk levels [15].
does not necessarily require its own risk level. Multiple cells To calibrate risk matrices, the overall facility risk toler-
in a risk matrix are assigned to the same risk level when ance criteria must be allocated to events or scenarios by
common decision requirements are applicable. estimating the number of hazardous events or hazard sce-
The desirable number of risk levels may vary according to narios possible and dividing the overall facility risk toler-
the types of consequences and types of casualties addressed. ance criterion by that number [15,16]. For people, both
The number of risk levels should be chosen to avoid problems individual and group risk are of concern. Each has its own
with the logical structure of risk matrices [13,14]. risk tolerance criteria. Consequently, risk matrices are
needed for each type of risk to people. Also, the number of
Assignment of Risk Levels events or scenarios may differ for different facilities and
Different decision requirements are associated with each therefore risk matrices must be calibrated for each facility.
risk level in risk matrices. Some risk matrices apply the same Similarly, the number of scenarios for each consequence
decision guidance to events and scenarios of comparable type will vary and risk matrices may need to be calibrated
risk. In such cases, assignments must be consistent so that for each consequence type individually. Furthermore, the
combinations of severity and likelihood values that yield the reference risk tolerance criteria may differ for different facil-
same risk values are assigned to the same risk level, that is, ities and companies. Consequently, each facility and com-
the underlying risks for each risk level must be comparable pany will need to address its own appropriate calibration
for all events or scenarios assigned to that level. For exam- and use of customized risk matrices.
ple, a scenario with a severity of one fatality and a likelihood
of once every 100 years has the same risk value as a scenario Usage of Terms
with a severity of 10 fatalities and a likelihood of once every Consistent use of terms in risk rating schemes is essential to
1,000 years. As the risk value is the same, the same risk level avoid confusion. Definitions of key terms that are used should
can be assigned requiring the same decision requirements. be provided, for example, unsatisfactory, satisfactory, pro-
However, such assignments based on risk equivalence longed, short-term, widespread, extensive, localized, immedi-
ignore other risk characteristics that may be important. For ate, delayed, sensitive, nonsensitive, major, minor, immediate,
example, a high severity/low likelihood scenario may be and prompt. Absent clear definitions, one practitioner’s or
assigned to the same risk level as a low severity/high likeli- one team’s “widespread” will be another’s “extensive,” and
hood scenario but the former will likely be of greater concern so forth.
and different decision requirements will be necessary due to Furthermore, different terms should not be used when
aversion to high severity consequences. Thus, some compa- the same meaning is intended, for example, major injury
nies include such aversion in the risk matrix. In the example and significant injury, and media coverage and media atten-
above, the second scenario may be viewed as less tolerable tion, otherwise analysts will impute a difference assuming
owing to its greater severity, even though the linear risk (S 3 one is intended, even if that is not the case. In the absence
L) is the same. To incorporate aversion to such higher-severity of definitions, the matter cannot be resolved properly and
consequence scenarios, they can be assigned to a higher risk the ability of analysts to make consistent assignments likely
level that has more stringent decision requirements. Generally, will be impaired.
the risk rating scheme should not allow different scenarios Terms that may have legal connotations with unintended
with comparable risks to be assigned to different risk levels implications should be avoided and any abbreviations, acro-
unless risk aversion is incorporated intentionally. nyms, or initialisms should be defined.
Adjustments in the assignment of decision requirements
to risk levels can be made to address other differences in CONCLUSIONS
risk characteristics that exist when the risk values are the Risk matrices appear to be simple and useful tools for risk
same. For example, fear of the type of hazard exposure, management. However, numerous pitfalls exist for unwary

54 March 2018 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.37, No.1)
users. Their design must address their limitations to avoid 4. Risk management - Risk assessment techniques, ISO/IEC
generating invalid risk ratings, even by experienced users. 31010:2009, International Organization for Standardiza-
Uncritical and cavalier design of risk matrices will lead users tion, Geneva, Switzerland.
astray and lead to poor decisions on requirements for risk 5. L.A. Cox, D. Babayev, and W. Huber, Some limitations of
reduction and mis-managed risks in processes. qualitative risk rating systems, Risk Anal 25 (2005), 651–
Various items must be considered in the construction of 662.
risk matrices to avoid problems with their use. These items 6. L.A. Cox, What’s wrong with risk matrices? Risk Anal 28
include the overall ranges of scenario severities and likeli- (2008), 497–512.
hoods, the number and definitions of severity and likelihood 7. Guidelines for Hazard Evaluation Procedures, 3rd Edition,
levels, and the number of risk levels and their decision Center for Chemical Process Safety/American Institute of
requirements. Chemical Engineers, New York, NY, 2008.
Companies should develop risk matrices that produce 8. P. Baybutt, The importance of defining the purpose, scope,
consistent risk ratings across all their processes and facilities and objectives for process hazard analysis studies, Process
to encourage consistent decisions on risk reduction and to Safety Progress 34 (2015), 84–88.
provide a rational basis for the compilation of risk reduction 9. Reducing Risks, Protecting People, United Kingdom Health
recommendations into a centralized data base for their priori- and Safety Executive, HSE Books, Sudbury, UK, 2001.
tization and management. The design and calibration of risk 10. I. Eckerman, The Bhopal Saga - Causes and Conse-
matrices to a common standard and the performance of risk quences of the World’s Largest Industrial Disaster, Univer-
rating in accordance with a defined procedure help to sities Press, India, 2005.
ensure consistency. 11. P. Baybutt, Addressing Subjectivity and Uncertainty in
Using Risk Matrices. Loss Prevention Bulletin, Issue 252,
December 2016.
LITERATURE CITED 12. P. Baybutt, The ALARP principle in process safety, Pro-
1. P. Baybutt, “Analytical Methods in Process Safety Manage- cess Safety Progress 33 (2014), 36–40.
ment and System Safety Engineering – Process Hazards 13. P. Baybutt, Addressing issues in the design and use of
Analysis,” Handbook of Loss Prevention Engineering, J. risk matrices in process safety, 2015 Spring Meeting &
M. Haight (Editors), Wiley-VCH, Weinheim, Germany 11th Global Congress on Process Safety, Austin, TX,
(2013), 501–553. April, 2015.
2. Risk management - Vocabulary, ISO Guide 73:2009, Inter- 14. P. Baybutt, Designing risk matrices to avoid risk ranking
national Organization for Standardization, Geneva, reversal errors, Process Safety Progress 35 (2016), 41–46.
Switzerland. 15. P. Baybutt, Calibration of risk matrices for process safety,
3. Risk management – Principles and guidelines, ISO J Loss Prevention Process Ind 38 (2015), 163–168.
31000:2009, International Organization for Standardiza- 16. P. Baybutt, Allocation of risk tolerance criteria, Process
tion, Geneva, Switzerland. Safety Progress 33 (2014), 227–230.

Process Safety Progress (Vol.37, No.1) Published on behalf of the AIChE DOI 10.1002/prs March 2018 55