Qualitative Risk Analysis – An Introduction

The Qualitative Risk Analysis process is the 3rd process within the Project Risk Management Knowledge Area in the PMBOK Guide. This chapter is just an introduction to this topic. We will be covering this topic in great detail in the subsequent chapters.

We have completed Risk Identification and have created the risk register which contains all the information we know about the risks we have identified so far. At this point the risk register contains only the basic details like what the risk is plus any potential response that you think might be feasible. But, apart from this information the register is empty. So, in this stage, we are going to analyze these identified risks and add as much information as possible about those risks into the risk register.

Purpose of Qualitative Risk Analysis:

The purpose of this process is to prioritize risks in order to determine which risks require additional analysis. This helps the risk management team to focus on the higher priority risks.

The Qualitative Risk Analysis process asks questions like:

a. What is the probability of this risk occurring?
b. What is the impact to the project objectives, if this risk occurs?
c. How much time do we have, to respond to this risk?
d. Where should we spend our effort?
e. Etc.

The Qualitative Risk Analysis process uses the definition of Probability & Impact we set in the Risk Management Plan. Also, we will be using the Risk Probability & Impact Matrix. The purpose of using these set values is to reduce bias on how risks are assessed and ensure a consistent analysis of all risks. We covered this in one of our earlier chapters titled “Contents of the Risk Management Plan”. You can revisit that chapter to refresh your memory about risk probability and impact.

At the end of qualitative risk analysis, we may feel the need to further analyze a few of the selected high priority risks. These risks will be further analyzed in the quantitative risk analysis process. The image below summarizes the steps in qualitative risk analysis:

Prev: Section Summary - Overview of Risk Analysis


Next: Inputs - Qualitative Risk Analysis

Risk Analysis

Risk Analysis is by far the most important domain of Project Risk Management. So, it is no big surprise that this domain will contribute 30% of questions in the RMP Examination. This is the largest of the domains in the Risk Management Framework in terms of contribution to the exam questions. To recap the exam objectives of Risk Analysis are:

a. Identify Risks
b. Evaluate Risks using Quantitative & Qualitative Risk Analysis
c. Prioritize Risks
d. Establish Control Limits

In order to plan effectively for the risks, we need to first analyze them properly. The Risk Analysis domain gives us all the inputs we need in order to plan the risk responses for the event that the risk occurs.

Logically thinking, it makes a lot of sense to spend our time and effort on risks that have the highest probability of occurring or on risks that have the highest potential impact on our project. Doesn’t it?

How will we identify which risk has a higher probability or a higher impact when compared to others? This is exactly what the Quantitative & Qualitative Analysis aspects of Risk Analysis will help us with. Before we begin our analysis, we need to identify all possible risks that may occur. By analyzing these risks and by understanding our stakeholder risk tolerance levels, we can shortlist and arrive at the important (or high priority) risks that we need to concentrate on…

You might be wondering what this “Establish Control Limits” objective is doing in the Risk Analysis domain. Are you? Setting these control limits is also part of the Risk Analysis Domain. We set these control limits by analyzing the risk tolerance levels of our stakeholders. The Project Management Team will use these limits to monitor the risks and to implement the planned responses. So, it makes perfect sense to include this objective as part of this domain…

In order to conduct an efficient Risk Analysis we need:

1. Good Information Gathering Techniques
2. Ability to Understand and Utilize Historic Information
3. Tools and Techniques to perform Qualitative Analysis
4. Tools and Techniques to perform Quantitative Analysis
5. Good Decision Making Capabilities
6. Ability to Perform Stakeholder Sensitivity Analysis

If all these things are not too clear and are making you nervous, don’t worry… This is just the initial introduction chapter. We will be covering the Risk Analysis Domain in great detail until you understand it clearly.

Prev: Risk Communication

Next: Risk Response Planning

Chapter 18: Risk Management

Aim: To understand the following Risk Management Processes
• Plan Risk Management
• Identify Risks
• Perform Qualitative Risk Analysis
• Perform Quantitative Risk Analysis
• Plan Risk Responses

If you have read the PMBOK or my earlier series “PMP Certification - Study Guide” you would by now know that

“A Risk is an Uncertain Event that can affect your Project”

Remember that this risk can be either Negative (An Actual Risk) or Positive (An Opportunity).

PMI’s risk management philosophy is based on a proactive approach to preventing negative risks and enhancing positive risks. Key points that you must remember about risk are:

• Risk can be either positive or negative. Positive risks are opportunities; negative risks are threats.
• A risk breakdown structure (RBS) is used to organize risk in a hierarchical structure.
• Monte Carlo analysis is a technique using simulations and probability in determining quantitative risk analysis.
• Risk categories are important in classifying risk.
• Probability and impact are both needed to assess risks.
• Quantitative analysis is generally reserved for high-probability, high-impact risk.
• Risk management planning and risk response planning are not the same activities.
• Risk identification is an iterative process that is performed throughout the project, not just during planning.
• Decision tree analysis is a technique using probabilities and costs for structured decision making.
• Five of the six risk management processes are conducted during the planning process group.
• The risk register is an important tool for capturing and tracking risks.

Exam Watch:

Risk register is a term introduced by PMI for the document detailing information on risks. The risk register includes all identified risks, the impacts of identified risks, proposed responses, responsible parties, and the current status.
Risk Management Planning and Risk Response Planning

The first step in Risk Management is to plan how we are going to conduct the whole Risk Management exercise in our project.
The risk management plan includes the risk methodology, roles/responsibilities, budget, execution timing, and definitions for risk categories, probabilities, and impacts. It is a summation of how the project team will carry out the remainder of the risk management activities for the project.

Exam Watch:

The risk management plan is not the same as the risk response plan. The Risk Response Plan will contain the possible actions you must take when a risk actually happens whereas the Risk Management Plan is the overall approach to managing Risks in the Project.

The risk management plan is the single output of the plan risk management process. The table below shows the inputs, tools and techniques, and outputs for the plan risk management process.

Plan Risk Management
Inputs	Tools & Techniques	Outputs
Project scope statement Cost management plan Schedule management plan Communications management plan Enterprise environmental factors Organizational process assets	Planning meetings and analysis	Risk management plan

To know more about the Plan Risk Management Process Click Here

Risk Breakdown Structure (RBS)

A risk breakdown structure (RBS) is a tool that can be used to organize risks in a hierarchical fashion. The structure is defined using the risk categories. Even if an RBS is not used, risk categories are still defined in risk management planning. Risk categories can include

• Technical - Risk associated with using new technology.
• External - Risk associated with forces or entities outside the project organization. External risks can include external suppliers, customers, weather, and market conditions.
• Organizational - Risk associated with either the organization running the project or the organization where the project will be implemented.
• Project Management - Risk associated with project management processes.

Note that this is just a high level classification of Risks and you need to tweak this whole process to suit your needs in the Project that is being executed.

Risk Probability and Impact

Probability can be defined as the likelihood that a risk will occur. It can be expressed mathematically or as a relative scale (low, medium, high).

Impact is the effect a risk has if it actually occurs. It can also be defined on a relative scale or mathematically.

The team documents in the project management plan detail how probabilities and impacts are measured. For example, a red/yellow/green scale might be used, where high-probability, high-impact risks are red; low-probability, low-impact risks are green; and so on. Again, I repeat, how the risks are categorized and prioritized will vary based on the Project at hand and there is no Universal Rule as to how you must handle risks.

Exam Watch:

Both probability and impact are mandatory for evaluating risks. Think of it this way, how will you prioritize a risk if you do not know what the chances are of the risk happening and what the impact it would have if it occurs.

Risk Identification, Analysis, Response Planning, and Monitoring/Controlling

In the risk management process, completing the risk management plan is the first step. After the plan is in place, according to PMI the next steps in the risk management process are
• Risk Identification
• Risk Analysis (qualitative and quantitative)
• Risk Response planning
• Monitoring/controlling Risks (This is not in scope as part of this chapter on Planning. We will cover it in the chapter on Monitoring & Controlling)

Identify Risks

The identify risks process determines the risks that might affect the project and characterizes those risks.
Obviously, you need to identify all the possible risks that might affect your project if you are to have any success handling them. Isnt it? Keep in mind that identifying risks is not just the project manager’s responsibility; team members, subject matter experts, customers, stakeholders, and others are involved in this process.

The table below shows the inputs, tools and techniques, and outputs for the identify risks process.

Identify Risks
Inputs	Tools & Techniques	Outputs
Risk management plan Activity cost estimates Activity duration estimates Scope baseline Stakeholder register Cost management plan Schedule management plan Quality management plan Project documents Enterprise environmental factors Organizational process assets	Documentation reviews Information gathering techniques Checklist analysis Assumptions analysis Diagramming techniques SWOT analysis (Strength, Weakness, Opportunity, Threat) Expert judgment	Risk register

The Risk Register

The risk register is the output of the identify risks process. The risk register contains the following information:
• Risk description
• Date identified
• Category
• Potential responses
• Current status

Exam Watch:

Identify risks is not a one-time event that occurs just during the planning process. It should be conducted throughout the project, including when major milestones are reached and when an actual risk event occurs.

To know more about the Identify Risks Process Click Here

Qualitative and Quantitative Risk Analysis

Qualitative risk analysis provides further definition to the identified risks in order to determine appropriate responses to them. The key terms are probability and impact. Probability is important because it measures how likely a risk is to occur. A high-probability risk deserves more attention than a low-probability risk. Similarly, impact is a measure of how the risk will affect the project should it occur. A risk with low impact has a different response than one with a high impact.

Exam Watch:

Qualitative risk analysis is most concerned with ranking or prioritizing risks. It is used to determine which risks pose more of a potential effect on the project.

Qualitative risk analysis quickly prioritizes risks in order to conduct response planning and quantitative risk analysis, if required. Using the probability of the impact and a probability impact matrix, the project manager develops a prioritized list of risks. The output to this step is captured in the risk register.

The table below shows the inputs, tools and techniques, and outputs for the perform qualitative risk analysis process.

Perform Qualitative Risk Analysis
Inputs	Tools & Techniques	Outputs
Risk register Risk management plan Project scope statement Organizational process assets	Risk probability and impact assessment Probability and impact matrix Risk data quality assessment Risk categorization Risk urgency assessment Expert judgment	Risk register updates

To know more about Qualitative Risk Analysis Click Here

Quantitative risk analysis assigns numerical values to risks and looks at those risks that are high on the list of prioritized risks (The output of qualitative risk analysis). The goal of this process is to quantify possible outcomes for the project, determine probabilities of outcomes, further identify high impacting risks, and develop realistic scope, schedule, and cost targets based on risks.

The table below shows the inputs, tools and techniques, and outputs for the perform quantitative risk analysis process.

Perform Quantitative Risk Analysis
Inputs	Tools & Techniques	Outputs
Risk register Risk management plan Cost management plan Schedule management plan Organizational process assets	Data gathering and representation techniques Quantitative risk analysis and modelling techniques Expert judgment	Risk register updates

Exam Watch:

Quantitative risk analysis is more concerned with assigning each risk a numerical value. This value can then be used to figure out the relative impact that particular risk would have on the project.

To know more about Quantitative Risk Analysis Click Here

Planning Responses to Positive and Negative Risks

After all risks are identified, options to deal with the risks must be identified. Each risk is assigned to one or more owners to carry out the planned response. The responses are documented in the risk register after it has been updated in the plan risk responses process.

The table below shows the inputs, tools and techniques, and outputs for the plan risk responses process.

Plan Risk Responses
Inputs	Tools & Techniques	Outputs
Risk register Risk management plan	Strategies for negative risks or threats Strategies for positive risks or opportunities Contingent response strategies plan Expert judgment	Risk register updates Risk-related contract decisions Project management updates Project document updates

There are four possible responses to negative risks:

• Avoid (Best) – Eliminating the Actual Threat by taking some action
• Transfer – Shifting the Risk to another party
• Mitigate – Take steps to ensure that the chances of the Risk happening are reduced
• Accept – Let the Risk happen. Use Contingency Reserves to handle it

For positive risks the responses include

• Exploit (Best) – Take steps to ensure that the Opportunity happens
• Share – Enlist the help of a Third party to capitalize on the opportunity
• Enhance – Taking steps to increase the probability of the Opportunity happening
• Accept – Take no steps to take advantage of the situation

To know more about the Plan Risk Responses process Click Here

Exam Watch:

Risks should be re-evaluated when the following events occur:

• A risk trigger is identified
• A change request is approved
• Key project milestones are reached
• Project phases end
• Deviations are detected in variance and trend analysis
• Corrective or preventive actions are implemented

Prev: Chapter 17

Next: Chapter 19

Chapter 53: Performing Qualitative Analysis

Qualitative Analysis is the first step towards analyzing the risks that have been identified in the risk identification process. The qualitative analysis process is quick and cheaper. It gives you some feel about the risks, and then you can determine which risks needs to be analyzed further by using quantitative analysis.

The perform qualitative risk analysis process is shown as a picture below:

Input to Qualitative Risk Analysis

The Risk Register is a default input to this process. Apart from the risk register, the other inputs to this process are:

Project scope statement - When you are performing qualitative risk analysis, you want to know what kinds of risks you are dealing with. For example, are you already familiar with these risks? If your project is similar to previous projects, it might have well-understood risks. If it is a new and complex project, it might involve risks that are not well understood in your organization. So, how do you know what kind of project you are dealing with? Simply put, you have to take a look at the project scope statement and search for uncertainties.
Risk management plan - To generate the output of qualitative risk analysis, you will need the following elements of the risk management plan:

• Roles and responsibilities for performing risk management
• Budgeting
• Definitions of probabilities and impacts
• The probability and impact matrices
• Risk categories
• Risk timing and scheduling
• Stakeholders’ risk tolerances

If any of these input items was not developed during risk management planning, it can be developed during qualitative analysis.

Risk register - The risk register contains the list of identified risks that will be the key input to the qualitative risk analysis. Updated risk categories and causes of risks can also be useful elements of the risk register, which can be used in the qualitative risk analysis.
Organizational process assets - While analyzing risks, you will make use of the risk-related components of the knowledge base from previous projects, such as data about risks and lessons learned. You can also look into risk databases that may be available from industry organizations and proprietary sources.

Tools and Techniques for Qualitative Risk Analysis

Prioritizing risks based on their probability of occurrence and their impact if they do occur is the central goal of qualitative risk analysis. Accordingly, most of the tools and techniques used involve estimating probability and impact.

Risk probability and impact assessment - Risk probability refers to the likelihood that a risk will occur, and impact refers to the effect the risk will have on a project objective if it occurs. The probability for each risk and the impact of each risk on project objectives, such as cost, quality, scope, and time, must be assessed. Note that probability and impact are assessed for each identified risk.

Methods used in making the probability and impact assessment include holding meetings, interviewing, considering expert judgment, and using an information base from previous projects.

A risk with a high probability might have a very low impact, and a risk with a low probability might have a very high impact. To prioritize the risks, you need to look at both probability and impact.

Assessment of the risk data quality - Qualitative risk analysis is performed to analyze the risk data to prioritize risks. However, before you do it, you must examine the risk data for its quality, which is crucial because the credibility of the results of qualitative risk analysis depend upon the quality of the risk data. If the quality of the risk data is found to be unacceptable, you might decide to gather better quality data. The technique to assess the risk data quality involves examining the accuracy, reliability, and integrity of the data and also examining how good that data is relevant to the specific risk and project for which it is being used.

Risk urgency assessment - This is a risk prioritization technique based on time urgency. For example, a risk that is going to occur now is more urgent to address than a risk that might occur a few months from now.

Probability and impact matrix - Risks need to be prioritized for quantitative analysis, response planning, or both. The prioritization can be performed by using a probability and impact matrix; a lookup table that can be used to rate a risk based on where it falls both on the probability scale and on the impact scale.

Look at the table below: RXY, where X and Y are integers that represent risks in the two-dimensional (probability and impact) space.

Probability	Impact
0.00	0.05	0.15	0.25	0.35	0.45	0.55	0.65	0.75	0.90
0.20	R11	R12	R13	R14	R15	R16	R17	R18	R19
0.40	R21	R22	R23	R24	R25	R26	R27	R28	R29
0.60	R31	R32	R33	R34	R35	R36	R37	R38	R39
0.80	R41	R42	R43	R44	R45	R46	R47	R48	R49

This is how you read this matrix. R21 has a 40% probability of occurring and will have a 5% impact on the project. Similarly R49 has a 80% probability and will have a 90% impact on the project.

How to calculate the numerical scales for the probability and impact matrix and what they mean depends upon the project and the organization. However, remember the relative meaning: Higher value of a risk on the probability scale means greater likelihood of risk occurrence, and higher value on the impact scale means greater effect on the project objectives.

Each risk is rated (prioritized) according to the probability and the impact value assigned to it separately for each objective. Generally, you can divide the matrix in the table above into three areas; high-priority risks represented by higher numbers, such as R49, medium-priority risks represented by moderate numbers, such as R25, and low-priority risks represented by lower numbers, such as R12. However, each organization has to design its own risk score and risk threshold to guide the risk response plan.

Note that impact can be a threat (a negative effect) or an opportunity (a positive effect). You will have separate matrices for threats and opportunities. Threats in the high-priority area might require priority actions and aggressive responses. Also, you will want to capitalize on those opportunities in the high-priority area, which you can do with relatively little effort. Risks posing threats in the low-priority area might not need any response, but they must be kept on the watch list to ensure that you don't get any unwanted or unexpected surprises towards the end of the project.

Risk categorization - You defined the risk categories during the risk management planning and risk identification processes. Now you can assign the identified risks to those categories. You can also revisit the categorization scheme, such as RBS, that you developed for your project, because now you have more information about risks for the project. Categorizing risks by their causes often helps you develop effective risk responses.

Expert judgment - You may need expert judgment to assess the probability and impact of each risk. To find an expert, look for people who’ve had experience with similar projects in the not too distant past. While weighing the expert judgment, look for possible biases. Often experts are biased toward their area or idea.

Output of the Qualitative Risk Analysis: Updated Risk Register

The risk register was initiated during the Identify Risks process and is updated with the results from the qualitative risk analysis. The updates will be:
• Risks categorizations - This means arranging risks in different categories. This helps you identify the common root causes of the risks and the areas of the project that might require special attention. Furthermore, categorizing risks can bring order to a chaotic situation and makes the management of these risks easier and more effective.
• Prioritized list of risks - The risk register has lists of risks prioritized according to the probability and impact matrix discussed earlier in this article. A separate list can be created for each project objective, such as cost, quality, scope, and time. These lists help you prioritize efforts for preparing and executing risk responses. The risks may be ranked as high, medium, or low.
• Lists of risks - Using some criteria, you can make different lists of risks for effective management. Following are some examples:

o List of risks with time urgency - This list includes urgent risks that require attention now or in the near future.
o Watch list of low-priority risks - This list contains risks that are deemed unimportant by the qualitative risk analysis but that need to be monitored continually.
o List of risks for additional analysis and response - This list includes risks that need further analysis, such as quantitative analysis or a response action.

• Trends in the analysis results - By examining the results from the qualitative risk analysis, you might recognize a trend for specific risks. That trend might suggest further analysis or a specific risk response.

The main output of qualitative risk analysis is the prioritization of risks based on a probability and impact matrix for each objective. So each objective can have its own prioritized list of risks.

Qualitative risk analysis is a relatively quick and cost-effective way to prioritize risks for risk planning. It also lays the groundwork for the quantitative risk analysis if one is required for some of the identified risks.

Prev: Analyzing Risks

Next: Performing Quantitative Analysis

Chapter 52: Analyzing Risks

In the previous chapter, we learnt how to identify risks. Identifying risks is a big task and if we screw up this step, the results can be disastrous. However, if we follow all the guidelines as explained in the PMBOK, we can be certain that our risk identification process was done efficiently. The next step for us is to analyze these risks. We are going to learn exactly that in this chapter.

So, lets get started!!!

Analyzing Risks

Once the risks have been identified, you need to answer two main questions for each identified risk:

1. What are the odds that the risk will occur,
2. If it does occur, what will its impact be on the project objectives?

You get the answers by performing risk analysis.

There are two main forms of Risk Analysis:

1. Qualitative Risk Analysis &
2. Quantitative Risk Analysis

Qualitative Risk Analysis

This is used to prioritize risks by estimating the probability of the occurrence of a risk and its impact on the project.

Quantitative Risk Analysis

This is used to perform numerical analysis to estimate the effect of each identified risk on the overall project objectives and deliverables.

Usually, you prioritize risks by performing qualitative analysis on them before you perform quantitative analysis. We will learn both one by one in the subsequent chapters.

Prev: Identifying Risks

Next: Performing Qualitative Analysis