Disruption Series (3 of 8) - Likelihood, Impact and Uncertainty: Looking Beyond the Risk Matrix
Most organisations are familiar with the idea of assessing risk by considering two simple questions:
How likely is it to happen?
If it does happen, what would the impact be?
These questions underpin many organisational risk assessments. They help organisations prioritise resources, identify significant risks, and determine where planning effort should be focused.
This is a valuable process. But in an increasingly uncertain and interconnected world, it is no longer the whole story.
The value of likelihood and impact
Risk matrices have become a common tool across government, business, healthcare, emergency management, and community organisations. They provide a structured way to compare different risks. For example:
A prolonged workforce shortage may be considered highly likely with moderate impact.
A major earthquake may be considered unlikely but potentially catastrophic.
A cyber attack may be assessed as increasingly likely with significant operational impacts.
Thinking about likelihood and impact helps organisations prioritise. Not every disruption deserves the same level of attention.
But the future doesn't always fit inside a matrix
One challenge is that likelihood is based on what we know today. It assumes we have enough information to estimate how probable an event is. Increasingly, organisations are operating in environments where this assumption becomes more difficult.
Consider just the past decade. How many organisations predicted:
a global pandemic?
widespread remote working?
major international supply chain disruption?
rapid advances in artificial intelligence?
increasingly sophisticated cyber attacks?
Some organisations anticipated aspects of these changes. Few anticipated exactly how they would unfold. The future has a habit of surprising us.
High impact does not always mean low likelihood
Another common misconception is that rare events deserve less attention. Some low-likelihood events have consequences so significant that organisations invest considerable effort preparing for them. Likewise, some highly likely disruptions occur so frequently that organisations gradually adapt to them without recognising their cumulative effects.
For example:
Staff turnover may occur continuously.
Population ageing develops over decades.
Climate change influences many different aspects of community life.
Housing affordability gradually changes demand for services.
These slower disruptions may never trigger an emergency response, yet they can fundamentally reshape organisations over time.
Disruptions do not occur independently
Traditional risk assessments often consider each risk individually. Reality is usually more complicated.
Imagine a prolonged heatwave. At first glance it may appear to be an environmental event. But it may also contribute to:
increased electricity demand
power outages
telecommunications failures
health impacts
transport disruption
workforce shortages
increased demand for community services
What began as one disruption has become many. The challenge is no longer understanding the likelihood of a heatwave. It is understanding how different disruptions interact.
Uncertainty changes the conversation
Risk management asks:
"What do we know?"
Preparedness increasingly asks:
"What if what we know changes?"
Uncertainty does not simply mean lacking information. It also means recognising that circumstances evolve, assumptions prove incorrect, and entirely new challenges emerge.
This requires organisations to become comfortable making decisions without complete certainty.
That can be uncomfortable. But it is increasingly becoming part of organisational life.
From prediction to capability
If uncertainty limits our ability to predict the future perfectly, where should preparedness efforts be directed?
One answer is capability.
Rather than trying to predict every possible disruption, organisations can strengthen the capabilities that help them respond regardless of what happens. Capabilities such as:
understanding the wider system
building shared understanding
strengthening relationships
improving decision-making
learning from experience
collaborating across organisational boundaries
adapting as circumstances change
These capabilities remain valuable whether the disruption is a cyber attack, a pandemic, a flood, or something entirely unforeseen.
Risk management and adaptive capacity are complementary
This is not an argument against risk management. Risk assessments remain an essential part of organisational governance and preparedness. They help organisations prioritise effort and identify areas requiring attention. Adaptive capacity complements this work.
Risk management helps organisations prepare for known risks.
Adaptive capacity helps organisations navigate the uncertainty that remains.
Both are needed. One helps us anticipate. The other helps us adapt.
Looking ahead
Many disruptions do not remain isolated events. They spread across organisations, services, and communities, creating new challenges as they unfold. A disruption to one system often becomes a disruption to many others.
Understanding these cascading effects is becoming just as important as understanding the original event itself.
In the next article, we'll explore cascading disruption and why preparing for individual hazards is increasingly giving way to preparing for interconnected systems.