Probability Impact Graphs do not fly

Jan 15th, 2020

Probability Impact Graphs do not fly. For short PIGs do not fly was part of the title of a risk management course we gave at TMW 2012. In that course we explained why Probability Impact Graphs (PIGs) and “heat maps” are obsolete, misleading and should be abandoned.

We recently read a paper by D. Vose who is finally “kinda coming to our side”. We are delighted by his paper.

Indeed, at Riskope we started over ten years ago to point out the numerous misleading aspects of PIGs and to show that:

we were not alone, but part of a small group of researchers and authors. Vose indeed cites some of the same authors we cited then.
There are numerous issues PIGs cannot solve and their liabilities .
In particular that PIGs fail to support decision making and finally
ORE (Optimum Risk Estimates), our flag-ship methodology, solves all the problems that PIGs cannot solve and much more.

Common practice approaches including heat maps, Probability Impact Graphs do not fly !

Heat maps and PIGs are ubiquitous. This is a fact, and the reasons are the:

apparent, but actually misleading, simplicity of the approaches,
abundance of oversimplified software dealing with them,
perception that they provide a correct “screening level” prioritization and finally
the sometimes appealing characteristic of saying what the boss wants them to be saying!

Perhaps mostly because of biases, see the last bullet above, and the misunderstanding of the underlying limitations of PIGs, accidents have continued to occur. As a result, many have lost confidence in risk assessments. We have written many times that no one should attempt to perform a risk assessment without first carefully defining the system, identifying hazards. Yet, numerous PIGs-based attempts are performed through un-prepared workshops. Oftentimes participants do not even share a correct common glossary.

The matrices (heat maps, PIGs) are oftentimes the result of boiler-plate searches in the web. They sport arbitrary colors, arbitrary cell limits. That is without understanding that each one of these elements has an impact on the results.

Finally, the use of indexes (scores) in the definition of probabilities and consequences forbids the use of any sensible mathematical approach. That is true even with simplified but rational attempts to make sense of prioritization.

We use a classic example in our courses (in house at corporations, MBA, etc.) to point out the inability of PIGs to differentiate between risks. Think to a high prob/low consequence events (say the seasonal cold of your boss) and a low prob/high consequence event (say a severe explosion at your plant). Most of the time the “architecture” of the matrix you use will lead to the same coloring of these very different events. You may neglect a risk that proves to be intolerable when properly studied.

Risks are not “colored cells”

Risk are not colored cells. Risks are events with a probability (range) leading to complex ranges of consequences.

They are not a “dot in a colored box”. They are a complex entity that may hurt your operation and the public around it in various ways we call the “dimensions” of the consequences. For example: business interruption, health and safety, environmental, reputation, etc.

Risk may be tolerable or intolerable. The classification is not arbitrary, but the result of the analysis once we define the tolerance threshold. Intolerable risks may be tactical or strategic. The classification is not arbitrary, but again, the result of the analysis.

Tactical and strategic risks, as well as tolerable ones, allow companies to develop operational, tactical and strategic planning. The key is to allow rational, sensible and sustainable decision-making. This, of course works for traditional risks as well as for “new risks” like cyber and climate change-related ones.