¶ What is the Diri risk matrix?
The risk matrix in Diri is a classic visualisation with probability on the y-axis and consequence (impact) on the x-axis. In Diri, a risk is a combination of a cause, an event and a consequence. The cause has a probability of occurring, and the consequence has an impact estimate. The probability answers how likely it is that a threat will exploit a vulnerability. The consequence is estimated from the harm done to assets. The cause is managed with probability-reducing treatments, and the consequence with consequence-reducing treatments.
¶ Risk views
The matrix can show the risk picture in four views, depending on which treatments are counted:
- Before: without any treatments, also called inherent risk.
- Current: with implemented treatments.
- Planned: with implemented, planned and ongoing treatments — the residual risk the organisation accepts when it signs the plan.
- All: with all treatments in the assessment, except non-applicable ones.
A treatment counts by its status in the assessment the risk belongs to. In step 4 of the risk assessment, the matrix compares Current → planned, so you see how far each risk moves with the plan. Read how risk and treatment effects are calculated.
¶ The acceptance line
If your organisation uses an acceptance threshold, the matrix shows the acceptance line. Risks above it count as unacceptable. See Risk acceptance.
¶ Using the risk matrix
All risk matrices in Diri support drill-down. Click a risk bubble to see the risks at that position. You find the matrix in several places:
- On dashboards, the Risk Matrix widget shows the aggregated risk picture from all assessments visible to you. Drill down into a specific risk assessment by clicking the risk bubble and selecting the risk.
- The risk matrix on the risk assessment dashboard shows the risk picture for the object being assessed, with drill-down into each risk.
- The risk matrix in step 4, Treatments & cost-benefit, is used for the cost-benefit analysis of treatments.
The level descriptions can be opened from the forms where you set probability and consequence, so you can see what each level means while you assess.
¶ Configuring the risk matrix
Administrators configure the matrix in Settings, under the risk matrix settings of each module (Operational risk, Cyber security, Privacy). Adjust the names and number of rows and columns, and the threshold values for each level of impact and probability, according to your risk management policy. Each level can have a description. See Settings.
You can set the levels as you wish. The example below uses numerical, logarithmic scales instead of subjective levels.
