Improving the use of risk matrices at NASA

A risk matrix, commonly a 5 × 5 scorecard with dimensions for likelihood of a problem and consequence if the problem occurs, is a popular tool for communicating project risks. The NASA version [1] is a frequently cited reference for risk managers from many application fields. Cells in the 5 × 5 scorecard are colored red, yellow, and green to help project managers quickly prioritize and track significant risks. In 2008, Cox wrote a highly cited journal article articulating flaws with many applications of risk matrices including inconsistencies in risk rankings based on the fundamental characteristics of the matrix such as which cells are colored red, yellow, and green. This paper will review shortcomings of risk matrices identified by the authors from the literature and from experience using the tool at NASA. We will conclude with recommendations for how NASA risk managers can improve their use of risk matrices to continue to realize the benefits and to minimize the shortcomings.