Applying a Framework Where It Does Not Quite Fit
A regional water utility is adopting a widely used risk-management framework that prescribes identifying assets, scoring likelihood and impact on a 5x5 matrix, and treating risks above a defined threshold. The utility's board has set the threshold at a score of 12. During rollout, the team hits three problems. First, several cyber risks score 9 or 10 on the matrix but engineers insist they are catastrophic if realized, because a single event could contaminate supply for 40,000 residents. Second, the framework's 'likelihood' scale assumes historical frequency data, which the utility does not have for cyber events. Third, a regulator requires the utility to document treatment decisions for every risk above the threshold, but 60 percent of identified risks fall below it and the board wants to stop tracking them entirely. The program lead is under pressure to 'just apply the framework as written' so the rollout stays on schedule.
1. Evaluate whether the 5x5 matrix and the score-12 threshold are appropriate for this risk set, and explain the consequence of applying them mechanically.
Read the worked answer
The framework is being applied outside the conditions that make it valid, and mechanical application produces a specific, predictable failure: catastrophic-but-rare risks get filtered out.
- A 5x5 matrix multiplies likelihood by impact. High-impact, low-frequency events - exactly the profile of contamination or cyber incidents - land in the low-to-mid scores (9-10) by construction, not because they are unimportant. The arithmetic treats 'rare' as 'minor,' which is a category error when the impact is irreversible or affects 40,000 people.
- The likelihood scale assumes frequency data the utility lacks. Forcing a number anyway converts uncertainty into false precision; two analysts will assign different likelihoods and the score becomes an artifact of guesswork.
- The threshold then acts as a hard cutoff. Anything below 12 is not 'low risk,' it is 'risk we chose not to score accurately.'
Mechanical application is not neutral - it systematically under-weights the risks the board most needs to see. The framework is a tool, not a mandate; its scales and thresholds are parameters to be calibrated to the organization's risk appetite and data reality, and the program lead should say so explicitly rather than let schedule pressure dictate method.
2. Describe how the utility should adapt the framework while remaining defensible to the regulator.
Read the worked answer
Adapt the parameters while keeping the framework's discipline - documented identification, scoring, treatment, and review. Concretely:
- Separate impact from likelihood for high-consequence risks. Use a screening rule: any risk whose worst-case impact is catastrophic is escalated regardless of computed score. This is a common and defensible modification (a 'credible worst case' override), and it should be written into the methodology, not applied ad hoc.
- Replace false-precision likelihood with qualitative bands (e.g., 'no known precedent,' 'seen elsewhere in sector,' 'seen here') and state the basis. Documenting the uncertainty honestly is stronger than a fabricated frequency.
- Reframe the threshold as a triage line, not an amnesty line. Risks below 12 still get recorded and reviewed on a longer cycle; the board does not 'stop tracking' them, it sets a lower review frequency. This satisfies the regulator's documentation requirement and preserves institutional memory.
- Document the deviations and rationale in the risk methodology so the regulator sees deliberate calibration, not noncompliance.
The principle: a framework earns trust through consistent, documented application of stated rules. Changing a rule with reasons is legitimate; silently ignoring the framework or applying a cutoff that hides real risk is not.