A risk matrix alternative begins the moment you stop colouring cells and start writing down the assumption the choice depends on. The grid tells committees which box is red. It never tells the room whether the premise behind the expenditure is sound, which is why boards replace it.
One meeting stays with me. A 5x5 grid was on the wall, nine managers were in the room, the shutdown call had to be made by Friday. The facilitator kept dragging the maintenance item from one coloured box to the next while nobody would say, plainly, whether the plant should stop. People usually start looking for a risk matrix alternative after a meeting like that. In forty years of workshops, I have seen the same purchase made again and again: the room got its colour; nobody owned the shutdown decision.
That is what the matrix buys you: classification in place of judgment. Once the discussion becomes a debate about where to place the dot, consultants can run the workshop, software vendors can sell the dashboard, internal champions can administer the ritual, and auditors can inspect a tidy file. Meanwhile the live decision sits in the middle of the table, untouched.
A risk matrix alternative is a way of replacing colour-coded risk scoring with direct examination of the assumptions a decision depends on.
Why every risk matrix alternative still starts in the wrong place
Louis Cox showed in a 2008 paper that matrices produce ranking errors, poor resolution, and ambiguous inputs and outputs. A smaller quantitative risk can look larger once it has been pushed through the boxes. Nijs Jan Duijm's 2015 review reached the awkward companion conclusion: the weaknesses were already well known even while standards and companies kept baking them into formal criteria.
Holly Sutherland and her co-authors found in a 2022 study of 2,699 people that matrices were not consistently better than plain text for communicating risk, even with design tweaks. Ruri Proto's 2023 experiments found that colour boundaries themselves can sway choice. People begin treating the move from one colour band to the next as the achievement, as if crossing the line were the decision.
The research is not asking whether the colours are tasteful; it is showing that the grid cannot do the job people claim for it. That is not a communication problem; it is a design failure. A matrix forces unlike judgments about likelihood, consequence, and control strength into one coloured cell, then asks the board to treat the cell as if it had reached a conclusion. In my experience, that is a clerical trick, not governance.
Write down the one assumption your committee is treating as settled, and decide whether the evidence holds before the next review. Start the Walk →
A risk matrix alternative starts with the live decision
Risk only matters in relation to an objective. Strip out the live decision and all you have left is decorated uncertainty about the future, which is why risk cannot sensibly be ranked in the abstract.
When Roger Estall and I wrote Deciding, we were simply making competent practice explicit: Frame the decision first and Recognise assumptions before asking whether there is Sufficient certainty. I have used that sequence in boardrooms and crisis meetings, and it changes the talk. People have to say what they believe, what evidence supports it, and what would prove them wrong.
I spent ten years chairing the committee that produced AS/NZS 4360, and I sat through enough standards work to know what a standard can do. It can allocate responsibilities and tidy paperwork, but it cannot make a judgment for you. That is why ISO 31000 cannot rescue the matrix, and why the Universal Decision-Making Method begins with the live decision rather than an abstract catalogue. Consultants and certifiers prefer the abstraction because abstract machinery produces repeat work.
In my experience, a one-page assumptions table beats a two-hour heat-map session: state the decision, name the few assumptions carrying it, then record the evidence or trigger that would reopen the call. That is the point at which the matrix stops pretending to govern.
I have chaired reviews where that single page changed the room in ten minutes. The operations lead could finally say which assumption he did not believe, the finance lead could say which number was carrying too much weight, and the committee had to deal with an argument instead of admiring a picture. That is better work, and it is harder for the machinery merchants to monetise.
Tesoro shows what the matrix cannot see
Tesoro shows what a low-risk box can buy you: in 2010, a risk-matrix assessment rated sulfuric-acid sampling as low risk, yet four years later two releases at the Martinez refinery injured four workers. The February 2014 incident alone released about 84,346 pounds of sulfuric acid and burned two of them badly enough that each lost more than 150 days of work.
That low rating acted as a false certificate. Management could say the job had been assessed, but the sampling system, procedures, and protective gear had not been made safe. I have seen that separation repeatedly, especially in heavily papered organisations: the file looks complete, the work underneath is still being done on hope.
The live decision underneath Tesoro was whether operators should keep sampling acid with the equipment, procedures, and protective gear actually in place. Once you state it plainly, the matrix looks absurdly thin. The real questions are whether the controls exist, whether the sampling system is fit for the work, and who stops the task when a control fails. The matrix documented a category; it did not test the assumptions the work depended on.
That is why the matrix is worse than merely unhelpful. It tells management the sampling routine has been dealt with when it has only been coloured in, which suits anyone who needs the file to look complete by quarter end. I have seen internal champions defend that sort of paperwork with genuine zeal, because once the box is coloured they can say the process was followed. The same defect sits inside risk registers as well.
How to take a risk matrix alternative into the next meeting
If you need to replace the current process, do not promise a smarter grid; promise fewer hiding places, and take a one-page assumptions table into the meeting instead, with the decision at the top and the few assumptions underneath that still need defending.
Committees like pictures because pictures let nobody own a sentence. An assumptions table does the opposite: the board can challenge an assumption, demand evidence, or decide how much downside it is prepared to accept before committing. That is a governance argument, not a design preference.
If the audit committee insists on a visual, give it one after the thinking is done. A short table of assumptions, owners, and reopen triggers is more honest than a heat map because it shows what the decision rests on and what would force the issue back onto the table. I do not object to pictures as such; I object to the way committees use them to avoid writing down a sentence that somebody might later have to own.
When a committee asks me for a matrix, I still ask the same question Roger and I have put to clients for years: what decision are you trying to make? If nobody can answer, the machinery is already running without a purpose. If they can, write the assumptions down and leave the coloured squares for the annual report.
You could redesign the matrix and still leave the assumptions underneath it unrecorded.
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.