Who owns the full risk picture in your organisation?

A friend put it well recently when he said, "Many won’t pay £9.99 a month for a child tracker but would pay anything to know where their child is if they were missing." Risk management has a similar problem. The value is invisible until the moment it is needed.

By the time the problem is recognised, the absence of more effective risk management is not a question of overhead. It is a foreseeable damage limitation problem. This is the real overhead, and it delivers nothing. The answer is not less effort. It is better design.

But before we get to that, when did you last ask if your organisation is asking the right questions about risk?

Most risk frameworks ask two questions. How likely is a risk to materialise (Likelihood, aka Probability)? And if it does, how bad could it potentially be (Impact) if it is allowed to become an issue? Multiply these two factors together (L x I) and you have a total risk score. Plot the score on a heat map and you have a picture of your overall risk landscape, or risk profile, by severity.

The heat map is a simple grid. Each risk appears as a dot. The colour of the cell it lands in - green, amber, or red - reflects the combined score. At a glance, any board can see where risks cluster, which are potentially most severe, and how the picture is changing over time. That is L x I scoring. It is widely used, broadly understood, and genuinely useful. A high score tells you a risk deserves attention. It does convey how urgently.

A potentially more severe risk with a long lead time and a less severe risk approaching fast will sit in different positions on an L x I heat map. But neither position tells you which needs attention first! The L x I map demonstrates severity. It says nothing about urgency.

The question that L x I scoring cannot answer is the one that most directly drives the decision on when to bring mitigation to bear: how urgent is the need to act on this risk?

Proximity is the missing dimension. It asks a simple question: how close is this risk is to materialising as an issue? Scored on the same scale as Likelihood and Impact, typically 1 to 5, where five means imminent, it multiplies the L x I score to give a total P x L x I risk score: Proximity x Likelihood x Impact.

The often raised argument against better risk management is that it takes time. PMs are busy. The effort is disproportionate to the return. In my experience, the overhead argument is a myth, and it almost always describes those whose approach to risk management is weak; logging risks seldom revisited, scoring in ways that produce no actionable signal, updating registers only at reporting time and then filing them away.

On the heat map, the picture changes. The horizontal axis now shows the L x I band; how serious the risk is. Proximity becomes the vertical axis. What you see is different from the L x I map, sometimes strikingly so. Risks that sat quietly in green because their severity was low now move up, even to the top of the map because they are imminent. Risks that looked more urgent because of their high severity now drop in ranking because their potential impact is so distant.

The ranking has not changed arbitrarily. The data has answered a different question. Not how serious. How urgent?

Consider two risks on the same register. Risk 03 in the heatmaps below: Likelihood = 4, Impact = 4, a potentially significant risk, sitting firmly in the red zone of the L x I map. Proximity = 1 because its potential impact, if realised, will bite later next year. Now consider Risk 07: Likelihood = 3, Impact = 2, a potentially lower impact risk, firmly in the green zone on the L x I map. Proximity = 5, because its impact potential, if realised, could bite as early as next month.

Under L x I scoring, Risk 03 demands urgent mitigating action now, and Risk 07 barely registers. Under P x L x I scoring, Risk 07 demands urgent mitigating action now whilst Risk 03 barely registers. Under L x I scoring, nobody is looking at Risk 07.

This is not a theoretical problem. It is a governance problem. Boards receiving risk reports built solely on L x I scoring are, by design, seeing severity. They are not seeing urgency. Those are different questions, and in a fast-moving programme, they can point in quite different directions.

Adding Proximity to the scoring model also changes the escalation dynamic. Under L x I scoring, a PM deciding whether to escalate a risk is making a judgement call; how serious does this need to be before it is escalated up the governance chain? That call is influenced by time pressure, relationships, and organisational culture. Urgency that is not visible in the data is easy to defer.

When Proximity scoring is applied, the level of judgement needed to make that call is reduced. A risk with high proximity and sufficient combined L x I score escalates because the data says it should, not because the necessary confidence existed to push it up the governance chain. Escalation becomes faster and better evidenced. The right risks simply reach the right level sooner than they otherwise could.

The question boards should be asking always is "which risks pose the biggest threat to our programmes right now, and what is being done about them?" L x I scoring cannot fully answer. P x L x I scoring can.

The additional effort is a single scored field per risk assessment / review. Excel does the math. Whether that additional field earns its place depends on how much it costs when significant risk is imminent, but mitigation action is deferred for lack of urgency.

There is no need for your organisation to find out the hard way!

One further consideration. The value of adding Proximity to the scoring model is not uniform across all organisations or all programmes. In a low-stakes environment, where the potential cost or loss from any individual risk materialising is modest, L x I scoring may be adequate. The governance overhead of missed urgency is limited because the consequences are limited.

The calculus changes as the stakes rise. In programmes where the potential cost of a materialised risk is significant - large capital investment, major service transformation, politically visible delivery - the cost of a missed urgency signal rises with it. A risk that was imminent, invisible under L x I scoring, and which then materialised, will almost always cost more to manage as a crisis than it would have cost to mitigate in advance.

The overhead argument does not survive that comparison.

The question then becomes whether the cost of the one additional scored field per risk assessment is proportionate to potential organisational damage, in monetary or in reputational terms, if an imminent risk goes unmanaged. In high-consequence delivery environments, that is not a close call.

A note on calibration: The heat map colour boundaries used here - Green below a combined score of 7, Amber up to 15, Red above - reflect a default risk appetite of approximately 50% Green, 35% Amber, and 15% Red across the scoring grid. That balance is configurable. An organisation operating in a high-consequence environment might tighten the Red threshold, accepting more escalations in exchange for earlier intervention. A larger, more stable portfolio might widen it, reserving executive attention for genuinely critical exposure. The proportions are a governance decision, not a technical one.

One further point. The model is only as good as the discipline behind the scoring. An organisation where proximity is routinely scored at 3 - because it feels safe, or because nobody wants to trigger an escalation - will see a PLI map that looks much like its L x I equivalent. The differentiation only emerges when proximity is scored with intent. That requires a shared understanding of what each score means in practice, and a culture that treats the register as a live management tool rather than a reporting obligation.

A note on the scoring scale: All three dimensions - Proximity, Likelihood, and Impact - use the same 1 to 5 scoring range. That is deliberate. Research on human judgement shows that scoring consistency drops as the scoring range widens. On a 1 to 10 scale, two people assessing the same risk will diverge more than on a 1 to 5 scale. Keeping all three dimensions on the same more compact scale also ensures they multiply cleanly and carry equal weight in the total score.