A Vector-Based Approach to Dynamic Risk Management: Integrating Velocity into the 3D Risk Matrix - A transformative approach

Abstract

In this article, the author introduces a transformative approach to risk management by integrating temporal dynamics into the established three-dimensional (3D) risk matrix. Traditional two-dimensional (2D) models, which assess risks based on likelihood and impact, fail to capture the complexity and urgency inherent in modern projects. Building on the 3D Risk Matrix, where risks are positioned within a cube defined by likelihood, impact on time, and impact on cost, the proposed approach reconceptualises risks as dynamic vectors rather than static points.

This shift enables the incorporation of Risk Velocity, a critical and unexplored dimension that measures the speed at which risks materialise and escalate. The author expands on two distinct components of risk velocity, defined as Lead Time Velocity (LTV), representing the approach of a risk toward occurrence, and Impact Time Velocity (ITV), describing the rate at which consequences intensify post-occurrence. By applying vector mathematics, the proposed approach captures both magnitude and direction, offering a richer representation of risk severity and trajectory.

1. Introduction - Reassessing the Foundations of Risk Management

In an era characterised by increasing project complexity and interdependence, the demand for more improved and dynamic risk management methodologies has never been greater. Traditional approaches, while foundational, often fall short in capturing the full, multi-dimensional nature of modern risks. This paper builds upon established risk theory to propose a novel, vector-based framework that integrates the critical dimension of time. By reconceptualising risks as dynamic vectors rather than static points, we can achieve a more nuanced understanding of not only their potential impact but also the speed at which they approach and escalate.

The core practice of risk management is rooted in understanding and addressing uncertainty. The Association for Project Management (APM) Body of Knowledge (2019) provides a concise and powerful definition of risk: "The potential of an action or event to impact the achievement of objectives."

The traditional risk management process operates as a dynamic, cyclical flow, ensuring that risk analysis remains current as new knowledge emerges. This process involves several key stages (APM, 2019):

• Initiate: Establishes the strategy, roles, and scope, culminating in the creation of a Risk Management Plan.
• Identify: Involves finding and documenting all potential risk events that could affect the project.
• Assess: Increases the understanding of each risk's probability and potential consequences to inform decision-making.
• Plan Responses: Determines the appropriate actions to address the identified risks.
• Implement Responses: Puts the planned actions into effect and monitors their efficacy.

At the heart of this process lies a fundamental dichotomy in how risks are managed. Likelihood is managed through the implementation of robust governance and control mechanisms. Impact is managed through the execution of specific mitigating actions designed to lessen its severity.

2. Evolving Beyond Flatland: The 3D Risk Matrix Methodology

Accuracy in visualising and assessing complex risks is a supporting and valuable mechanism for any project team. However, conventional two-dimensional (2D) methodologies have faced growing criticism for their inability to capture the multifaceted nature of modern project threats.

Key criticisms include:

• Lack of visualisation & communication: Flat matrices fail to provide an intuitive picture of the overall risk landscape.
• Inability to combine Cost and Time impacts: Risks are typically assessed against either cost or time, but rarely both simultaneously, which is an inaccurate reflection of reality.
• Reliance on an arbitrary, sometimes subjective approach: The process feels and, on most occasions, is arbitrary, influenced and relies on simple integer multiplication.
• Human factor interventions: The assessment can be skewed by dominant voices rather than objective analysis.
• Lack of flexibility in ranking: The use of integers obstructs a more granular and realistic assessment.

To overcome these issues, the 3D Risk Matrix was developed (Antoniadis & Thorpe, 2003). The proposed model expanded the traditional framework by positioning risks within a three-dimensional space defined by three basic axes: Likelihood (L) in the 'x' direction, Impact on Time (IoT) in the 'y' direction, and Impact on Cost (IoC) in the 'z' direction.

Figure 1. A 3D representation of the 3x3 risk cube, illustrating the 27 potential risk combinations formed by the three axes. (Antoniadis & Thorpe, 2003).

As described in Antoniadis & Thorpe (2003), a core innovation of this methodology is the concept of "Risk Pyramids." Rather than treating risks as isolated points, the model recognises that they can exist in the space between the integer coordinates. Pyramids are formed by connecting adjacent coordinates within the main cube, creating discrete zones of risk priority.

Figure 2. The Risk Pyramids are formed within the highest-risk cube, allowing for granular, position-based prioritisation. (Source: Antoniadis & Thorpe, 2003).

At the ISEC-02 Conference in 2003, the author presented a case study of applying the 3D Risk Matrix (3DRM) methodology on an airport Fuel Management Unit.

Figure 3. Case study results of the use of 3DRM in the assessment of risks for an FMU. (Presented at ISEC-02 Conference in Rome. Source: Antoniadis & Thorpe, 2003)

3. The Missing Dimension: Introducing the Theory of Risk Velocity

To manage risk proactively, it is not adequate to understand if a risk might occur and what its impact might be. The team and the PM need to understand the speed at which it can affect a project. The concept of Risk Velocity provides this essential temporal dimension, transforming risk analysis from a static snapshot into a dynamic forecast.

This concept can be deconstructed into two distinct and equally important components:

• Lead Time Velocity (LTV) or Time To Cause (TTC): This is the speed at which a risk can materialise. It measures the period between the present moment and the point at which the risk event is likely to occur. It answers the question: How fast is the risk approaching?
• Impact Time Velocity (ITV) or Time To Impact (TTI): This is the speed between the risk event occurring and the point where its full consequences are felt. It measures the rate at which damage escalates after the risk has materialised. It answers the question: Once it happens, how fast will the damage spread?

4. A New Synthesis: Reimagining Risks as Vectors in 3D Space

In this section the author will synthesise the spatial awareness of the 3D Risk Matrix with the temporal dynamics of Risk Velocity. By moving beyond a conception of risks as static coordinates, we can reimagine them as vectors, mathematical objects which possess both magnitude and direction.

The author proposes that a risk located at coordinates (L, IoT, IoC) within the 3D cube can be represented as a position vector. This vector originates from the point of zero risk, <0, 0, 0>, and terminates at the risk's coordinates. For example, for a risk with L=2, IoT=3 and IoC=3, the risk will terminate at point C and have coordinates <2,3,3>. This primary vector, which we will call OC, represents the path the risk takes as it materialises.

Figure 4a. 3D risk vector with secondary threat vector (CD) caused by initial risk (vector OC) and the Impact Time Velocity vector (CC1).

Figure 4b. 3D risk vector (OC) with the Impact Time Velocity vector (CC1)

5. The Mathematical Framework: Applying Vector Theory to Risk Dynamics

To operationalise the vector-based risk model, a foundational understanding of vector mathematics is essential. The general formula for the vector equation of a line in 3D space is:

r(t) = r0 + t * v

Each component of this equation has a specific meaning:

• r(t): The position vector of any point on the line.
• r0: The position vector of a known starting point on the line (e.g., the origin).
• v: The direction vector of the line, which defines its orientation and slope.
• t: A scalar parameter that "scales" the direction vector, allowing one to move along the line.

The pivotal argument for applying this to risk management lies in the interpretation of the parameter 't'. In pure mathematics, 't' is merely a scalar. However, in physics/kinematics as also in the context of project management, which operates entirely within the dimension of time, 't' is not just a scalar but should be interpreted as a time variable, measured in units such as hours, days, or weeks.

Figure 5a. A 3D example of a vector r(t) = r0 + t*v with r0 coordinates <0,0,0> and coordinates for v <2,3,3>.

Figure 5b. A 3D line from the origin showing how a risk's position vector doubles from r(1)=<2,3,3> to r(2)=<4,6,6> as the time parameter t increases from 1 to 2.

6. The Dynamic Risk Velocity Model: A Proposed Concept

This section represents the culmination of the preceding concepts, formally defining a complete, dynamic risk model. This framework is comprised of two key vectors that together capture the temporal journey of a threat: the Lead Time Velocity (LTV) vector, which describes its path to occurrence, and the Impact Time Velocity (ITV) vector, which models the escalation of its consequences.

6.1. The Lead Time Velocity (LTV) Vector: The Path to Occurrence

The Lead Time Velocity (LTV) is represented by the primary threat vector OC. This vector originates at the point of zero risk, <0, 0, 0>, and terminates at the coordinates of the identified risk C = (L, IoT, IoC) within the 3D cube. Its magnitude indicates the overall severity, while its direction reveals the nature of the impending impact.

Figure 6. The primary threat vector OC, representing LTV, and the secondary Impact Time Velocity vector CC1 representing ITV.

Figure 7a. Depicts equal Components.

Figure 7b. The LTV vector OC deconstructed into its component vectors on the (a) Time/Cost, (b) Likelihood/Time, and (c) Likelihood/Cost planes.

6.2. The Impact Time Velocity (ITV) Vector: The Escalation of Consequence

Once a risk event occurs at point C, its likelihood is no longer a variable; it has happened. At this moment, a second velocity becomes critical: the Impact Time Velocity (ITV). The ITV is represented by the secondary vector CC1, whose origin is at point C, the endpoint of the LTV vector. Two potential models are proposed for how this ITV vector operates:

A 2D Plane Model: In this model, the ITV vector acts exclusively on the 2D plane defined by the Impact on Time (IoT) and Impact on Cost (IoC) axes. Since the likelihood is fixed at 100%, the velocity of the consequences is a function of only time and cost impacts.

Figure 8. Possible directions for the ITV vector CC1 operating within the 2D plane of Impact on Time and Impact on Cost.

Figure 9. Diagram of the ITV of risk CC1 operating in a 2D plane made up of axes IoT and IoC.

Figure 10. An example of the isolated 2D planes where risk velocity CC1 operates.

Figure 11. Full diagram of ITV vector of risk OC operating in a 2D plane made up of all the IoT and IoC axes, negative and positive.

A 3D Space Model: An alternative and more sophisticated model introduces a new third axis: "Reaction Time." After a risk occurs at point C, the ITV vector operates in a new 3D space defined by IoT, IoC, and Reaction Time. This model is powerful because it quantifies the project team's response capability as a third dimension of the impact, modelling how delays in reaction can exacerbate cost and time consequences.

Figure 12. The ITV vector CC1 is operating in a 3D space where the third axis represents the team's Reaction Time.

Figure 13. 3D perspective of ITV vector CC1 of threat OC against axes, Reaction Time, IoT and IoC

Figure 14. 3D perspective of the ITV vector with its components

7. Conclusion and Future Directions

The author has attempted to present a fundamental evolution in risk assessment, arguing for a shift from a static, point-based methodology to a dynamic, vector-based model. By incorporating the temporal dimensions of Lead Time Velocity (LTV) and Impact Time Velocity (ITV) into a three-dimensional risk space, organisations can gain unprecedented insight into the true nature of threats.

The primary advantages of adopting this 3D vector-based methodology are transformative, offering greater clarity, proactivity, and analytical rigour. Avenues for future work include:

• The development of a Risk Analysis software that could visually pinpoint risks within the 3D pyramids and model their vector trajectories in real-time.
• The application of the vector methodology to assess opportunities, modelling them as vectors that can be maximised rather than threats to be mitigated.
• The introduction of different axes to model other critical types of risk, such as those related to Safety, Environment, or Reputation, creates a truly multi-faceted risk model.

Ultimately, by embracing the mathematics of vectors and the physics of velocity, this methodology has the potential to transform risk management. It can elevate the practice from a reactive, compliance-driven exercise into a truly predictive and strategic discipline, empowering project leaders to navigate uncertainty with greater foresight and confidence.