Two Scores, One Supplier
A procurement team must rank two critical software suppliers before contract renewal. The risk analyst has produced a 5x5 heat map. Supplier A: Likelihood 4, Impact 3. Supplier B: Likelihood 2, Impact 5. The heat map's colour bands are non-linear - the band containing A (12) is amber, and the band containing B (10) is also amber, but the underlying loss estimates differ sharply. A's plausible failure is a 3-day outage affecting 40% of order processing; B's is a data breach with an estimated £2.4m exposure and regulatory notification duties. The head of procurement says: 'Both are amber, so treat them the same - renew both with standard terms.'
1. Explain why the equal colour band does not justify equal treatment, and what the scores conceal.
Read the worked answer
The heat map collapses two dimensions into one ordinal position, and colour bands then collapse that position further. Two risks can share a band while differing in:
- Nature of harm. A's loss is operational and recoverable (a 3-day outage). B's is a breach with regulatory notification, potential fines, and reputational damage that persists after remediation.
- Tail behaviour. A's impact of 3 is fairly bounded. B's impact of 5 sits in a distribution with a long tail - the £2.4m estimate may be a central case, not a worst case.
- Control leverage. A 3-day outage can be mitigated by failover and manual workarounds. A breach cannot be 'worked around' once data has left.
- Velocity. A breach may be undetected for months; an outage is immediately visible.
Treating both as 'amber, standard terms' is a category error: the colour is a communication device, not a decision rule.
2. Propose how the analyst should present these two risks so that a non-specialist decision-maker can act on them.
Read the worked answer
Move from a single ordinal score to a short structured profile per supplier:
- Scenario statement - one sentence each on what failure looks like.
- Loss range - low / central / high, in currency, rather than a 1-5 impact score.
- Recoverability - can operations continue, and for how long?
- Regulatory exposure - yes/no, and which obligations trigger.
- Control effectiveness and residual position - what is already in place, and what the residual risk is after controls.
Then present the comparison as a decision: B warrants bespoke contractual terms (breach notification SLAs, insurance, audit rights) regardless of its lower likelihood score, because its downside is asymmetric and less recoverable. A warrants resilience clauses (failover, RTO commitments). The point is to let the decision-maker see why the treatment differs, not to hand them a colour.