Step 2: Project Governance
Tool 1: Example Risk Framework
This tool is for use in conjunction with Step 2 of the Commissioning Toolkit document
Whilst this model was developed by the Department of Transport to respond to increasing threat to transport services, particularly air travel, the principles and format of the MATRA approach provide a good basis for risk assessment for this project. The needs of this project mirror DOT’s requirement for co-ordination across stakeholders and a joined up approach to the consideration and mitigation of risks. 
Overall the system is similar to that being adopted by NHS organisations seeking to establish robust risk assurance frameworks to minimise the impact of business risks on operational and strategic goals. However, the MATRA model enables the assessment of risks against a predefined template and scoring of impact is assessed in four areas:
•	Safety;
•	Operations;
•	Economic, and;
•	Reputation
For each area risks identified against two scales, each marked 0 to 4, for likelihood and impact. These are multiplied and provide an overall rating of green (1-2) – the lowest risk rating, amber (3-6) and red (8-16), the highest risk rating, table below.

Risk rating Matrix
Likelihood score    →  	1: Improbable	2: Unlikely	3: Likely	4:  probable	
Consequence score  ↓					
4: Catastrophic 	4	8	12	16	
3: Major 	3	6	9	12	
2: Moderate 	2	4	6	8	
1: Minor 	1	2	3	4	

 Risk Assessment

RAG Score/Rating	
Risk Assessment	
CRITICAL
(12-16)	•	There are insufficient controls in place to address the cause or source of the risk
•	Controls are considered insubstantial or ineffective
•	Controls are being implemented but are not yet in place
•	If this risk were to materialise, the situation could be irrecoverable in terms of the project’s reputational/financial well being and or organisational service continuity.	
SEVERE
(6-9)	The project Board feels concerned about carrying this risk. There are few controls in place, which are considered substantial and/or effective and address the cause of the risk. The consequences of the risk materialising, though severe, can be managed to some extent via contingency plans.	
MANAGEABLE
(1-4)	The project board is prepared to accept this level of risk. The risk is considered to be small and there are sufficient controls in place which address or substantially control the cause of the risk. The consequences of the risk materialising can be managed via contingency plans.	
Once identified changes to project activities or further planning processes will be used to seek to mitigate risks, reducing their impact and likelihood wherever possible.