Heat Map Distortion

For most risk systems one big selling point is the heat map. It's tidy, it's colorful and in a macabre kind of way, it really energizes management to stare in ore at risks registered in the red zone. For the consultant it is a dream come true and the more they find wrong with a business, the more valuable they seem to become.

Worthy or not, traditional heat maps distort risk reality, they squeeze risk into a two dimensional perspective that makes the reporting process itself as dangerous as it is useful.

Thinking inside the box

We have to accept that the heat map approach for looking at risk is a type of thinking that is very much in the box.

Risks are registered and categorized as being high frequency / high impact at the extreme end of the spectrum, through a range of places that end up in a green zone (normally down in the bottom left-hand corner of the map) which is designated as low frequency / low impact. Being green is an entirely opposite place of operating and at times risk managers struggle to move everything they can from "extremistan" (a Nassim Taleb coined term) to some station of normality.

Causal Capital | Heat Map Distortion (click to enlarge) 

This way of actualizing anything is normal. People sort, bin, group many aspects of their lives which have value and managers absolutely love heat maps but in the world risk, they "confusticate" reality. For simplicity sake, let's list four dangers of the heat map, there are more than four, but let's stick to four:

[1] Risks are often correlated but the heat map doesn't show this. What it does, is put two or more risks side by side for comparison without representing the inference between the risks. One is kind of left choosing one risk over another for resolution when actually these risks may share the same controls or causal path.

[2] Heat Maps look at risk from only one perspective, the exposure value. They don't show the cost of control or the benefit of taking restricted budget away from one control to improve another.

[3] Heat Maps are a point in time expression of exposure which drive management to obtain green flags rather than red flags at any cost. Performance is akin to moving your risks across the battlefield of exposure, when in reality each move changes the relative nature of the entire landscape.

[4] Finally, the green zone, the orange zone which is often used for risks we don't fully understand and the red zone, consume equal amounts of space. This is a linear and departmental way of seeing risk. If risk is curvature, it would follow that the zones are unlikely to be equidistant unless the scale of the graph is in some way exponentially represented. 

So why do we use risk heat maps, if they have so many problems?

Thinking outside the box

Management have an affinity for them, it is a summary of their position from a risk perspective and risk heat maps are easy to understand. I like heat maps for the very same reasons, so we should keep the creatures but we need to change the way they operate otherwise we are truly kidding ourselves.
  

Causal Capital | Extending the heat map (click to enlarge) 

There are few things we can do to curtail the dangers of the heat map and the slides that are attached to this post explain these points in summary.

Firstly we need to extend our heat map so that it can show control costs vs outcome, contribution of risk price against cost as a function and the opportunity cost for investing in one control over another. If we don't do this, risk is always going to be relegated as a cost centre to a business rather than an investment, however  hard the risk manager claims otherwise. While this sounds simple, in the end you will probably find that a real option model is going to solve your problems here.
  

Causal Capital | Extending the heap map further (click to enlarge) 

Correlation should at the very least be attempted especially for "relatively large" exposure values. 

In doing this, the heat map is moved away from a 2-Dimensional graph to a 3-Dimensional surface of exposure. Is this hard to do, well it won't work unless the risk framework under the heat map is capturing the right data but this isn't an out of the question kind of modelling or it shouldn't be.

So that's our heat map evolved but remember if you come across the 2-Dimensional predecessor, don't leap in and make rash risk decisions from perusing the map alone, especially in the red end of the field, without considering the cost model and the risk spread price.