Aggregating risk matrices under a normative framework

Risk matrices have been proven as useful risk management tools, especially in the cases where data are not sufficient. Current usage of risk matrices in both literature and practice is related to single risk assessment. However, sometimes the decision makers care more about the overall risk consisting of several of single risks, which is in the scope of the aggregation of single risks measured by risk matrices. Unfortunately, two notions, namely, incomparability of different qualitative risk ratings and incomparability of different risk types, hinder the aggregation of risk matrices. Therefore, few literature studied on this issue and even ISO have not given a solution. In this paper, a general framework for risk matrix aggregation is proposed. The basic idea is to transform the risk matrices into other equivalents to operate the aggregation process. Based on this framework, three methods, namely, the fuzzy set method, the interval number, and the probability density function methods, are introduced. The three methods are applied to an illustrative example to show the feasibility of the general framework. Then these methods are compared from three different aspects, i.e., comprehensibility, complexity, and degree of explanation of risk matrix. In practice, when these methods are employed to aggregate risk matrices, the findings of this paper show that the interval number method is the least robust; though the probability density function method has a lower degree of explanation of risk matrix, it could be taken as a substitution as the fuzzy set method, thanks to its simplicity.