Internal Controls Design website by Matthew Leitch (tutor, researcher, author, & consultant)
New website, new perspective: - Related articles - All articles - The author - Services

Research 1

Risk register study 1: Impact Spread

by Matthew Leitch, 16 January 2008


This is the first of a series of simple studies of real risk registers that aims to provide improved understanding of what people do when asked to work on a risk register.

The objective of this study was to examine the incidence of a phenomenon referred to here as 'Impact Spread'. If we want to characterise risks appropriately we must understand Impact Spread.

The results show that risks that could have a range of impacts are very common for a number of reasons. In fact, they are the overwhelming majority of risks. Consequently, methods of characterising risks that ask people to give views on potential impact must make it clear how Impact Spread is to be handled. Just asking for 'the impact', without explanation, and expecting a single number or rating is inappropriate.

Impact Spread

What is Impact Spread? Take a risk like "Building Collapse" (verbatim from a risk register in the research collection). What is the impact of "Building Collapse"? Clearly it depends on the building, the forewarning, whether anyone is in the building at the time, and probably other important factors too.

It could be as trivial as a garden shed falling down during a storm and chipping a garden gnome, or as horrific as a high rise building in a busy city centre toppling sideways, killing thousands.

This is what I call Impact Spread. It is a common feature of risk register items.

The risk register from which this was taken has another box for 'impact' and the answer must be one of the categories 'insignificant', 'minor', 'moderate', 'significant', or 'catastrophic.' Is the impact of "Building Collapse" 'minor'? It could be. What about 'catastrophic'? Again, it could be. This is the problem most people experience as a result of Impact Spread and there are a number of responses to it.

Reasons for Impact Spread

There are several reasons for Impact Spread and this study looks at how prevalent each is across a range of typical published risk registers. Here are the reasons studied, starting with the easiest to spot.

Prevalence of Impact Spread for different reasons

A total of 14 risk registers from the collection were analysed, providing 384 examples of risk register items. Each item was assessed and decisions made about what reasons for Impact Spread were present. Judgement was often needed to decide what the intention of the writer had been. However, only a very small number of risk register items were so unclear that no decision could be made at all. Only 0.83% of judgements were prevented by lack of clarity.

Reason% of items affected*
Explicit multiple outcomes23%
Multiple objects71%
Multiple occasions86%
Obvious variable extent87%
Other variables extent100%

* To be precise, this is the percentage of risk register items where a decision could be reached that exhibited Impact Spread for the given reason.

Each reason for Impact Spread, taken individually, is sufficient to require risk characterisation methods to cater properly for Impact Spread.

There were some variations between risk registers.

Risk RegisterType**Number of itemsExplicit multiple outcomes*Multiple objects*Multiple occasions*Obvious variable extent*Other variables extent*

* This is a percentage of the total items in the register, not just those that could be classified.

** These mean:

Further reading

For an introduction to this series of studies and more information about the collection of risk registers used, read "An introduction to the Risk Register Studies".

For research on how people like to characterise risks, try "Favourite ways to characterise risks."

© 2008 Matthew Leitch
New website, new perspective: - Related articles - All articles - The author - Services

If you found any of these points relevant to you or your organisation please feel free to contact me to talk about them, pass links or extracts on to colleagues, or just let me know what you think. I can sometimes respond immediately, but usually respond within a few days. Contact details

Matthew Leitch - Author

About the author: Matthew Leitch is a tutor, researcher, author, and independent consultant who helps people to a better understanding and use of integral management of risk within core management activities, such as planning and design. He is also the author of the new website,, and has written two breakthrough books. Intelligent internal control and risk management is a powerful and original approach including 60 controls that most organizations should use more. A pocket guide to risk mathematics: Key concepts every auditor should know is the first to provide a strong conceptual understanding of mathematics to auditors who are not mathematicians, without the need to wade through mathematical symbols. Matthew is a Chartered Accountant with a degree in psychology whose past career includes software development, marketing, auditing, accounting, and consulting. He spent 7 years as a controls specialist with PricewaterhouseCoopers, where he pioneered new methods for designing internal control systems for large scale business and financial processes, through projects for internationally known clients. Today he is well known as an expert in uncertainty and how to deal with it, and an increasingly sought after tutor (i.e. one-to-one teacher). more

Please share:            Share on Tumblr