ICT Risk matrix

The risk matrix diagram below follows the guidelines set out by Queensland Treasury and Trade A Guide to Risk Management—July 2011. It combines the likelihood of the risk occurring and the consequence should such a risk occur, to result in the risk rating for treating and/or monitoring the risk.

The QGEA uses this matrix and associated rating scales in its assessment of ICT initiative and system risk and provides them here for agency reference only.

	Consequence
Likelihood	Insignificant	Minor	Moderate	Major	Critical
Rare	LOW Accept the risk Routine management	LOW Accept the risk Routine management	LOW Accept the risk Routine management	MEDIUM Specific responsibility and treatment	HIGH Quarterly senior management review
Unlikely	LOW Accept the risk Routine management	LOW Accept the risk Routine management	MEDIUM Specific responsibility and treatment	MEDIUM Specific responsibility and treatment	HIGH Quarterly senior management review
Possible	LOW Accept the risk Routine management	MEDIUM Specific responsibility and treatment	MEDIUM Specific responsibility and treatment	HIGH Quarterly senior management review	HIGH Quarterly senior management review
Likely	MEDIUM Specific responsibility and treatment	MEDIUM Specific responsibility and treatment	HIGH Quarterly senior management review	HIGH Quarterly senior management review	EXTREME Monthly senior management review
Almost certain	MEDIUM Specific responsibility and treatment	MEDIUM Specific responsibility and treatment	HIGH Quarterly senior management review	EXTREME Monthly senior management review	EXTREME Monthly senior management review

Below are presented scales for rating likelihood and consequence that can be applied to initiative risk and to system risk.

Example rating scale for risk likelihood—initiatives and systems

The following rating scale considers the likelihood that a specific risk will occur and can be used in the assessment of likelihood for both ICT initiatives and ICT systems.

Likelihood scale	Criteria	Description
Rare	0–5%	Extremely unlikely or virtually impossible
Unlikely	6–25%	Unlikely to occur
Possible	26–50%	Fairly likely to occur
Likely	51–75%	More likely to occur
Almost certain	More than 75%	Almost certain will occur

Example rating scale for risk consequence (initiatives)

The following rating scale considers the resultant impact on the business should a risk occur and can be used in the assessment of consequence for ICT initiatives.

If multiple impacts could occur with different consequence ratings then the most critical impact should be selected as the overall rating to ensure appropriate management of the risk.

	Consequence scale
Type of impact	Insignificant	Minor	Moderate	Major	Critical
Impact to cost	<$150k	$150k–$500k	$500k–$1.5m	$1.5m–$5m	>$5m
Impact to time	<10 days	10–20 days	20–40 days	40–60 days	>60 days
Impact to scope	Minor change to ancillary requirements	Change to ancillary requirements	Change to multiple requirements	Change to any critical requirements	Major change to any critical requirements
Impact to government reputation	Little to no impact; control of impact can be managed internally	Some impact to government reputation; control of impact can be managed internally	Moderate impact to government reputation; control of impact can be managed internally, but risk is high that other parties may need to be involved	Major impact to government reputation; control will involve a number of agencies	Significant impact to government reputation; media news coverage; involves the Minister or Premier

Example rating scale for risk consequence (systems)

The following rating scale considers the resultant impact on the business should a risk occur and can be used in the assessment of consequence for ICT systems.

If multiple impacts could occur with different consequence ratings then the most critical impact should be selected as the overall rating to ensure appropriate management of the risk.

	Consequence scale
Type of impact	Insignificant	Minor	Moderate	Major	Critical
Risk to individual safety	None or negligible	N/a	N/a	Any risk to personal safety	Directly threatens life
Distress caused to any party	None or negligible	N/a	Short term distress	Limited long term distress	Substantial long term distress
Public order	None or negligible	N/a	Measurable impact	Prejudice	Seriously prejudice
Damage to any partys standing or reputation	None or negligible	N/a	Short term damage	Limited long term damage	Substantial long term damage
Inconvenience to any party	None or negligible	Minor inconvenience	Minor inconvenience	Significant inconvenience	Substantial inconvenience
Inappropriate release of personally or commercially sensitive data to third parties	There is no release or negligible release of sensitive information	Minor impact	Measurable impact, breach of regulations or commitment to confidentiality	Release of information would have significant impact	Would have major consequences to a person, agency or business
Impact on Government finances or economic and commercial interests	No or negligible impact	N/a	Cause financial loss or loss of earning potential	Work significantly against	Substantial damage
Financial loss to any client of the service provider or third party	None or negligible	Minor loss	Moderate loss	Significant loss	Substantial loss
Financial loss to agency or service provider	None or negligible	< 2% of monthly agency budget	2%– 5% of monthly agency budget	5%–10% of monthly agency budget	> 10% of monthly agency budget
Threat to government agency systems or capacity to conduct their business	None or negligible	N/a	N/a	Agency business or service delivery impaired in any way	Agency business halted or significantly impaired for a substantial period
Assistance to crime or impact on its detection	Would not assist or would cause only negligible hindrance to detection of unlawful activity	N/a	Prejudice investigation or facilitate commission of violations that will be subject to enforcement	Impede investigation or facilitate commission of serious crime	Prevent investigation or directly allow commission of serious crime
Impact on development or operation of major government policy	No or negligible Impact	Minor impact	Impedes effective development or operation	Seriously impede	Substantially impede
Impact on the environment	None or negligible	Minor impact on the environment	Measurable short term damage to the environment	Limited long term damage to the environment	Substantial long term damage to the environment
Impact on agency or Queensland Government workforce	None or negligible	Minor impact	Measurable impact	Limited long term impact	Substantial long term impact
Impact on risk of litigation	None or negligible	Minor impact	Measurable impact	Significant impact	Substantial impact