Some commentators on risk assessment consider that “heat maps” are a waste of time. This posting discusses some of their advantages and disadvantages. A much more detailed discussion is also contained in my book Business Risk and Simulation Modelling in Practice.
Heat maps are a two-dimensional visual representation of a set of risks, where each is described and plotted on a probability-impact axis (where quantitatively or qualitatively defined). They can be used to visually represent a set of risks that is documented in a risk register.
Whilst risk registers (especially qualitative ones) can be a quick and effective tool (and support or facilitate a process to identify risks and develop mitigation measures), the probability-impact framework really applies only to a limited and specific type of risks (broadly to operational-type risks). They may also act as a first step to a more in-depth process that may lead to full modelling of risk.
Unfortunately, they are of very limited genuine applicability; outside an “operational risk” context, the reality of the situation is not captured by a probability-impact mapping. To force every risk (or uncertainty) into this framework is like putting “a square peg in a round hole”, with the process creating a misleading or false façade of accuracy and rigour, whilst its calculated results (e.g. total portfolio risk profile) likely to be highly inaccurate, as well as being insufficient for the various needs of project stakeholders (forecasting, resource planning, financing etc). Typically, one needs information about the time profile of multiple variables (revenue, cost, cash flow) and to capture dependencies between them. This cannot generally be done accurately in a probability-impact framework. (For example, the reader may reflect on how “oil price risk” may be interpreted in this framework versus the true behaviour).
Qualitative registers may provide some useful process facilitation (e.g. risk identification and mitigation), but in most cases one should be cautious in using the “heat map” framework as a basis to extend into a full quantitative model.
See the book Business Risk and simulation Modelling in Practice for a more in-depth discussion.