Introduction to Quantitative Risk Analysis

We have successfully completed Qualitative Risk Analysis and updated the Risk Register. The next step would be Quantitative Risk Analysis. This section is dedicated to look in great detail about the Quantitative Risk Analysis process.

Quantitative Risk Analysis:

In the previous section on “Qualitative Risk Analysis” we prioritized risks and came up with a list of risks that are high priority and require additional analysis. Well, in Quantitative Risk Analysis, we are going to focus on those risks. The purpose of Quantitative analysis is to assign a numeric rating to the risk. This will help the risk management team to numerically analyze the risk which will aid them in the decision making process.

If you have already prepared for the PMP Exam or are PMP Certified, you must know by now that Quantitative analysis is the 4th process in the PMBOK Guides coverage of Risk Management. If you do not remember this, then I suggest you revisit the chapter titled Big Picture of Risk Management in our PMP Certification study series.

According to the PMBOK guide, we will analyze all those risks that potentially and substantially impact our project and our project objectives. Risks that have higher impact on our project with a higher probability of occurrence are those that we need to concentrate on.

While Qualitative Analysis is quick and cost effective, Quantitative analysis can be more time consuming and costly. Depending on the size of our project, the time and effort/cost we need to spend in this step (Quantitative Analysis) will vary. In some smaller projects, we may ignore this step altogether because it may not be prudent or feasible to spend that much time or resources in this activity. However, in most cases, a feasibility analysis or a cost benefit analysis is undertaken to decide whether to proceed with Quantitative analysis or not.

As you might have guessed by now, performing quantitative analysis can be very useful because it helps us make informed decisions in uncertain circumstances. So, if you have the time and resources to take up this step, it is advisable to perform Quantitative Risk Analysis.

Before we dig into the details of Quantitative Risk Analysis, let me repeat something that I have said multiple times. This step is not done only once after Qualitative Analysis. It is repetitive and may be required to be taken up after the “Develop Risk Responses” step or the “Monitor & Control Risks” step. At the end of day, we need to have as much information as possible about the risks that may impact our project and the only way to accomplish that is by thorough analysis.

Prev: Updates to Risk Register - After Qualitative Analysis

Next: Inputs Used in Quantitative Risk Analysis

Section Summary – Overview of Risk Analysis

In this section we took a very high-level look at the Risk Analysis domain of the PMI Risk Management Professional certification examination. Let us now quickly summarize what we have learnt so far.

• Analyzing Risks is the next logical step a risk manager has to perform after risks are identified
• Risk Analysis is used to gauge the impact and probability of the risk to shortlist a few critical risks that may affect our project so that we can concentrate on those risks
• Risk Analysis includes two sub tasks - Qualitative Risk Analysis and Quantitative Risk Analysis
• Risk Analysis increases the team and the managers confidence level in dealing with risks
• It allows us to control risks with a greater success rate
• It helps us to create better responses to the risks
• Risk analysis is not a onetime activity. It is repetitive and we can send a risk for further analysis from both the Respond to Risks process as well as the Monitor & Control Risks process
• Both Risk Analysis and Risk Management are an integral part of project risk management. That is why the PMI RMP exam gives this domain a 30% weightage in terms of no. of questions that appear on the exam

Prev: Risk Analysis & Project Management

Next: Qualitative Analysis - An Intro

What is Risk Analysis?

In the previous sections we have taken a detailed look at the Risk Management Plan, Risk Register and almost everything else that you do in the starting stages of your projects risk management. You have identified the risks and have communicated it with your stakeholders. So, as per the risk management process flow, what will you do next?

“Analyze those Risks”

People easily confuse risk analysis and risk management. They think that analyzing risks is all risk management does. Unfortunately, they fail to realize that analyzing risks is only a part of risk management and there are a lot of activities after we actually finish analyzing the risks. In a majority of cases, people don’t do any dedicated risk management activity at all. So, I would say that, those who confuse these two activities and at least do perform risk analysis are better than those who don’t perform any risk management activities at all.

What is Risk Analysis?

If you ask this question to someone who has been working on multiple projects in their career, the will answer in either of the below ways:

a. It involves numerical analysis
b. It heavily revolves around the risk’s impact and probability
c. It requires expert judgment
d. It relies on stakeholder tolerance of risks
e. Etc.

Actually speaking all of these responses above is correct.

Yes, risk analysis involves numerical analysis. The person is probably referring to the Quantitative Analysis part of risk analysis. During the course of risk analysis we are always concerned about the chances as to whether a risk will happen or not and the impact of a risk if it happens. So, point no.2 is right as well. The whole risk analysis activity is not stand-alone. The project or the risk manager cannot do risk management by himself. He will enlist the help and expertise of SMEs both internal and external to the organization (as required) along with the help of risk experts who may be either within or outside the project. So, all in all, the whole risk management activity utilizes the expertise of numerous experts and hence point no.3 is right as well.

All said and done, the analysis we do and the steps we take to manage risks will all be guided by the “Stakeholder Risk Tolerance”. If your project sponsor or customer is old-school and doesn’t like taking chances, then in all probabilities you won’t be taking any major risks in your project. So, point no.4 is correct as well.

Risk Analysis typically involves:

a. Risk Identification
b. Risk Assessment and
c. Numerical Analysis of Risks

In the previous chapters we learnt about the creation of the Risk Register and the Risk Management Plan. Do you remember that the Risk Management Plan contains the Probability & Impact Matrix? This probability and impact matrix will be used in risk analysis. It is those risks that we identified and added to the Risk Register that will be analyzed in this stage. Risk Analysis tells us what areas of the project are prone to be affected by risks. It guides us in developing better responses. It also helps us understand which risks require a response, if so when along with details on how drastic a response is required for the risk. Unless we do proper risk analysis, there is no way we can come up with a proper response that can actually help us manage the risk.

Prev: Section Summary - Communicating Project Risks

Next: Goals & Benefits of Risk Analysis

Risk Analysis

Risk Analysis is by far the most important domain of Project Risk Management. So, it is no big surprise that this domain will contribute 30% of questions in the RMP Examination. This is the largest of the domains in the Risk Management Framework in terms of contribution to the exam questions. To recap the exam objectives of Risk Analysis are:

a. Identify Risks
b. Evaluate Risks using Quantitative & Qualitative Risk Analysis
c. Prioritize Risks
d. Establish Control Limits

In order to plan effectively for the risks, we need to first analyze them properly. The Risk Analysis domain gives us all the inputs we need in order to plan the risk responses for the event that the risk occurs.

Logically thinking, it makes a lot of sense to spend our time and effort on risks that have the highest probability of occurring or on risks that have the highest potential impact on our project. Doesn’t it?

How will we identify which risk has a higher probability or a higher impact when compared to others? This is exactly what the Quantitative & Qualitative Analysis aspects of Risk Analysis will help us with. Before we begin our analysis, we need to identify all possible risks that may occur. By analyzing these risks and by understanding our stakeholder risk tolerance levels, we can shortlist and arrive at the important (or high priority) risks that we need to concentrate on…

You might be wondering what this “Establish Control Limits” objective is doing in the Risk Analysis domain. Are you? Setting these control limits is also part of the Risk Analysis Domain. We set these control limits by analyzing the risk tolerance levels of our stakeholders. The Project Management Team will use these limits to monitor the risks and to implement the planned responses. So, it makes perfect sense to include this objective as part of this domain…

In order to conduct an efficient Risk Analysis we need:

1. Good Information Gathering Techniques
2. Ability to Understand and Utilize Historic Information
3. Tools and Techniques to perform Qualitative Analysis
4. Tools and Techniques to perform Quantitative Analysis
5. Good Decision Making Capabilities
6. Ability to Perform Stakeholder Sensitivity Analysis

If all these things are not too clear and are making you nervous, don’t worry… This is just the initial introduction chapter. We will be covering the Risk Analysis Domain in great detail until you understand it clearly.

Prev: Risk Communication

Next: Risk Response Planning

Chapter 52: Analyzing Risks

In the previous chapter, we learnt how to identify risks. Identifying risks is a big task and if we screw up this step, the results can be disastrous. However, if we follow all the guidelines as explained in the PMBOK, we can be certain that our risk identification process was done efficiently. The next step for us is to analyze these risks. We are going to learn exactly that in this chapter.

So, lets get started!!!

Analyzing Risks

Once the risks have been identified, you need to answer two main questions for each identified risk:

1. What are the odds that the risk will occur,
2. If it does occur, what will its impact be on the project objectives?

You get the answers by performing risk analysis.

There are two main forms of Risk Analysis:

1. Qualitative Risk Analysis &
2. Quantitative Risk Analysis

Qualitative Risk Analysis

This is used to prioritize risks by estimating the probability of the occurrence of a risk and its impact on the project.

Quantitative Risk Analysis

This is used to perform numerical analysis to estimate the effect of each identified risk on the overall project objectives and deliverables.

Usually, you prioritize risks by performing qualitative analysis on them before you perform quantitative analysis. We will learn both one by one in the subsequent chapters.

Prev: Identifying Risks

Next: Performing Qualitative Analysis