Introduction to Quantitative Risk Analysis

We have successfully completed Qualitative Risk Analysis and updated the Risk Register. The next step would be Quantitative Risk Analysis. This section is dedicated to look in great detail about the Quantitative Risk Analysis process.

Quantitative Risk Analysis:

In the previous section on “Qualitative Risk Analysis” we prioritized risks and came up with a list of risks that are high priority and require additional analysis. Well, in Quantitative Risk Analysis, we are going to focus on those risks. The purpose of Quantitative analysis is to assign a numeric rating to the risk. This will help the risk management team to numerically analyze the risk which will aid them in the decision making process.

If you have already prepared for the PMP Exam or are PMP Certified, you must know by now that Quantitative analysis is the 4th process in the PMBOK Guides coverage of Risk Management. If you do not remember this, then I suggest you revisit the chapter titled Big Picture of Risk Management in our PMP Certification study series.

According to the PMBOK guide, we will analyze all those risks that potentially and substantially impact our project and our project objectives. Risks that have higher impact on our project with a higher probability of occurrence are those that we need to concentrate on.

While Qualitative Analysis is quick and cost effective, Quantitative analysis can be more time consuming and costly. Depending on the size of our project, the time and effort/cost we need to spend in this step (Quantitative Analysis) will vary. In some smaller projects, we may ignore this step altogether because it may not be prudent or feasible to spend that much time or resources in this activity. However, in most cases, a feasibility analysis or a cost benefit analysis is undertaken to decide whether to proceed with Quantitative analysis or not.

As you might have guessed by now, performing quantitative analysis can be very useful because it helps us make informed decisions in uncertain circumstances. So, if you have the time and resources to take up this step, it is advisable to perform Quantitative Risk Analysis.

Before we dig into the details of Quantitative Risk Analysis, let me repeat something that I have said multiple times. This step is not done only once after Qualitative Analysis. It is repetitive and may be required to be taken up after the “Develop Risk Responses” step or the “Monitor & Control Risks” step. At the end of day, we need to have as much information as possible about the risks that may impact our project and the only way to accomplish that is by thorough analysis.

Prev: Updates to Risk Register - After Qualitative Analysis

Next: Inputs Used in Quantitative Risk Analysis

Section Summary – Overview of Risk Analysis

In this section we took a very high-level look at the Risk Analysis domain of the PMI Risk Management Professional certification examination. Let us now quickly summarize what we have learnt so far.

• Analyzing Risks is the next logical step a risk manager has to perform after risks are identified
• Risk Analysis is used to gauge the impact and probability of the risk to shortlist a few critical risks that may affect our project so that we can concentrate on those risks
• Risk Analysis includes two sub tasks - Qualitative Risk Analysis and Quantitative Risk Analysis
• Risk Analysis increases the team and the managers confidence level in dealing with risks
• It allows us to control risks with a greater success rate
• It helps us to create better responses to the risks
• Risk analysis is not a onetime activity. It is repetitive and we can send a risk for further analysis from both the Respond to Risks process as well as the Monitor & Control Risks process
• Both Risk Analysis and Risk Management are an integral part of project risk management. That is why the PMI RMP exam gives this domain a 30% weightage in terms of no. of questions that appear on the exam

Prev: Risk Analysis & Project Management

Next: Qualitative Analysis - An Intro

What is Risk Analysis?

In the previous sections we have taken a detailed look at the Risk Management Plan, Risk Register and almost everything else that you do in the starting stages of your projects risk management. You have identified the risks and have communicated it with your stakeholders. So, as per the risk management process flow, what will you do next?

“Analyze those Risks”

People easily confuse risk analysis and risk management. They think that analyzing risks is all risk management does. Unfortunately, they fail to realize that analyzing risks is only a part of risk management and there are a lot of activities after we actually finish analyzing the risks. In a majority of cases, people don’t do any dedicated risk management activity at all. So, I would say that, those who confuse these two activities and at least do perform risk analysis are better than those who don’t perform any risk management activities at all.

What is Risk Analysis?

If you ask this question to someone who has been working on multiple projects in their career, the will answer in either of the below ways:

a. It involves numerical analysis
b. It heavily revolves around the risk’s impact and probability
c. It requires expert judgment
d. It relies on stakeholder tolerance of risks
e. Etc.

Actually speaking all of these responses above is correct.

Yes, risk analysis involves numerical analysis. The person is probably referring to the Quantitative Analysis part of risk analysis. During the course of risk analysis we are always concerned about the chances as to whether a risk will happen or not and the impact of a risk if it happens. So, point no.2 is right as well. The whole risk analysis activity is not stand-alone. The project or the risk manager cannot do risk management by himself. He will enlist the help and expertise of SMEs both internal and external to the organization (as required) along with the help of risk experts who may be either within or outside the project. So, all in all, the whole risk management activity utilizes the expertise of numerous experts and hence point no.3 is right as well.

All said and done, the analysis we do and the steps we take to manage risks will all be guided by the “Stakeholder Risk Tolerance”. If your project sponsor or customer is old-school and doesn’t like taking chances, then in all probabilities you won’t be taking any major risks in your project. So, point no.4 is correct as well.

Risk Analysis typically involves:

a. Risk Identification
b. Risk Assessment and
c. Numerical Analysis of Risks

In the previous chapters we learnt about the creation of the Risk Register and the Risk Management Plan. Do you remember that the Risk Management Plan contains the Probability & Impact Matrix? This probability and impact matrix will be used in risk analysis. It is those risks that we identified and added to the Risk Register that will be analyzed in this stage. Risk Analysis tells us what areas of the project are prone to be affected by risks. It guides us in developing better responses. It also helps us understand which risks require a response, if so when along with details on how drastic a response is required for the risk. Unless we do proper risk analysis, there is no way we can come up with a proper response that can actually help us manage the risk.

Prev: Section Summary - Communicating Project Risks

Next: Goals & Benefits of Risk Analysis

Risk Management & the PMBOK Guide

Are you PMP certified? Or have you read the PMBOK Guide? If so, you would already know that Risk Management is one of the 9 Project Management Knowledge Areas. The Risk Management Knowledge area of the PMBOK Guide will be a valuable resource in your preparation for the Risk Management Professional certification exam. Our exam preparation will closely follow how the PMBOK guide covers Risk Management.

If you are not PMP certified yet or do not have a copy of the PMBOK guide, don’t worry. In my earlier series on the PMP Certification exam preparation, I have covered the area of Risk Management in great detail. If you go through the chapters on Risk Management there, you should have more than enough information to proceed with your RMP exam preparation…

Risk Management Processes – As Per the PMBOK Guide

As per the PMBOK Guide, the Risk Management Knowledge Area is split into 6 distinct processes. Below is a short description of those processes with a link to learn more details about it. Those links contain the details regarding each of these processes from the PMBOK’s Perspective. That will be the basis for us in understanding the details that we will be covering in future from the RMP Exam perspective. So, spend some time and go through those chapters so that you establish the minimum level of knowledge required to easily progress towards the RMP Certification Examination.

The Risk Management Knowledge area includes the following Processes:

1. Plan Risk Management – Risk management planning is the process used to decide how the risk management activities for the project at hand will be performed. You can learn more about this Plan Risk Management process by Clicking Here
2. Identify Risks – The Identify Risk Process is the process where we actually identify all those uncertain events that might affect our project or its outcome. You can learn more about the Identify Risks process by Clicking Here
3. Perform Qualitative Risk Analysis – This is the process where we assess the Probability of the Risk event occurring and the Impact of the same. At the end of this process we will have a prioritized list of risks that we need to analyze further. You can learn more about the Perform Qualitative Risk Analysis process by Clicking Here
4. Perform Quantitative Risk Analysis – This is the process where we take the prioritized list of risks and apply mathematical analysis on them. You can learn more about the Perform Quantitative Risk Analysis process Clicking Here
5. Plan Risk Responses – This is the process where we will be deciding how we are going to handle the risks identified & analyzed in the previous processes if they occur. You can learn more about the Plan Risk Responses process by Clicking Here
6. Monitor & Control Risks – This is the process where we monitor the identified risks and identify & respond to new risks as they appear. You can learn more about the Monitor & Control Risks process by Clicking Here.

The whole Risk Management activity progresses step by step through these 6 processes. This is exactly how this blog is structured too. An important point to note here is that, the output of each of these processes serves as the input to the subsequent process. We will start with Plan Risk Management and progress towards Monitor & Control Risks…


The Risk Management Plan

The Risk Management Plan is the heart of our Risk Management activity and it is the artifact based on which we will be taking up each and every activity of Risk Management. The Risk Management Plan (we will call it RM Plan going forward) is a component of the Project Management Plan. We will be using the following as inputs to create the RM Plan:

a. Cost Management Plan
b. Schedule Management Plan
c. Communications Management Plan
d. Project Scope Statement
e. Organizational Process Assets &
f. Enterprise Environmental Factors

Don’t worry if you think I haven’t given much detail about the RM Plan creation here because there will be a whole section dedicated to it in future…

Key Inputs & Outputs of these Risk Management Processes

The RM Plan is the key output of the Plan Risk Management Process. As outlined in the previous paragraph on the Risk Management processes, the Identify Risks process takes this RM Plan as input and creates the Risk Register as the output. Each of the subsequent processes will take this Risk Register as input and then add or update it with more details and pass it on as input to the next process. This means that the Risk Register is going to be updated multiple times as it goes from Identify Risks to the Monitor & Control Risks process.

Along with the Risk Register, the Monitor & Control Risks process also uses Performance Reports (from the Report Project Performance process) and the Work Performance Information (from the Directing and Managing Project Execution process) that are created during the general Management of the Project. Also, any changes that may be suggested as output of this process will be submitted and put through the Perform Integrated Change Control process.

Prev: What is Project Risk?

Next: Understanding the Project Environment

Risk Analysis

Risk Analysis is by far the most important domain of Project Risk Management. So, it is no big surprise that this domain will contribute 30% of questions in the RMP Examination. This is the largest of the domains in the Risk Management Framework in terms of contribution to the exam questions. To recap the exam objectives of Risk Analysis are:

a. Identify Risks
b. Evaluate Risks using Quantitative & Qualitative Risk Analysis
c. Prioritize Risks
d. Establish Control Limits

In order to plan effectively for the risks, we need to first analyze them properly. The Risk Analysis domain gives us all the inputs we need in order to plan the risk responses for the event that the risk occurs.

Logically thinking, it makes a lot of sense to spend our time and effort on risks that have the highest probability of occurring or on risks that have the highest potential impact on our project. Doesn’t it?

How will we identify which risk has a higher probability or a higher impact when compared to others? This is exactly what the Quantitative & Qualitative Analysis aspects of Risk Analysis will help us with. Before we begin our analysis, we need to identify all possible risks that may occur. By analyzing these risks and by understanding our stakeholder risk tolerance levels, we can shortlist and arrive at the important (or high priority) risks that we need to concentrate on…

You might be wondering what this “Establish Control Limits” objective is doing in the Risk Analysis domain. Are you? Setting these control limits is also part of the Risk Analysis Domain. We set these control limits by analyzing the risk tolerance levels of our stakeholders. The Project Management Team will use these limits to monitor the risks and to implement the planned responses. So, it makes perfect sense to include this objective as part of this domain…

In order to conduct an efficient Risk Analysis we need:

1. Good Information Gathering Techniques
2. Ability to Understand and Utilize Historic Information
3. Tools and Techniques to perform Qualitative Analysis
4. Tools and Techniques to perform Quantitative Analysis
5. Good Decision Making Capabilities
6. Ability to Perform Stakeholder Sensitivity Analysis

If all these things are not too clear and are making you nervous, don’t worry… This is just the initial introduction chapter. We will be covering the Risk Analysis Domain in great detail until you understand it clearly.

Prev: Risk Communication

Next: Risk Response Planning

The Risk Management Framework

In the previous section, we learnt about the basic details about the PMI Risk Management Professional certification. This is going to be the first actual chapter in our study plan for this PMI RMP certification exam.

Overview of the Risk Management Framework

The Project Management Institute suggests a Framework that is tried & tested and widely used to manage project risks. It is extremely important to understand the basics of this Risk Management Framework.

There are 4 key domains in this Risk Management Framework. They are:

1. Risk Communication
2. Risk Analysis
3. Risk Response Planning &
4. Risk Governance

Our study plan will be revolving around each of these 4 domains of the Risk Management Framework. Before we go any further into these individual domains, let us now look at the basic details related to these domains and also look at the Exam Objectives that we need to focus on for the PMI RMP Exam.

Risk Communication

The Risk Communication domain deals with how effectively we can communicate about risk related events with all the Project Stakeholders. Risk Communication plays a key role in the overall Risk Management strategy because, as the Project Manager, it is our foremost priority to keep all stakeholders apprised of the Situation in the Project. They key exam objectives of this domain are:

a. Apply Interpersonal Skills
b. Assess Stakeholder Risk Tolerance
c. Document Risk Related Information &
d. Create Regular Status Reports

Risk Analysis

The Risk Analysis domain is by-far the most critical domain of the Risk Management Framework in terms of the impact it can have on the overall Risk Management Strategy in the Project. This is because, unless you can analyze risks properly you cannot plan effectively plan how to handle them and eventually result in project delays and losses. The key exam objectives of this domain are:

a. Identify Risks
b. Evaluate Risks using Quantitative & Qualitative Risk Analysis
c. Prioritize Risks
d. Establish Control Limits

Risk Response Planning

The Risk Response Planning domain too is a very critical domain of the Risk Management Framework because, this is where we actually create plans on how we are going to handle the risk events if they occur. Unless our response is appropriate, the risk will cause project delays and losses. The key exam objectives of this domain are:

a. Develop a Risk Response Strategy
b. Develop a Contingency Approach & Plan
c. Present the Recommendations to Key Stakeholders

Risk Governance

The Risk Governance domain sets up baselines & standards that you wish your project to follow. This is where we actually handle the risk events when they occur. We also take necessary steps to improve our process to ensure that the chances of risk events occurring are kept to the minimum. The key exam objectives of this domain are:

a. Document Lessons Learned
b. Refine Risk Policies & Practices
c. Create the Risk Management Plan
d. Establish metrics for the Risk Management Processes
e. Examine Process Performance
f. Monitor Risk Performance
g. Identify Relevant Policies & Standards

If all this information seems overwhelming to you, just relax and go through the chapter once more. This is just the first chapter. We still have a very long way to go where we will be covering each of these areas in detail…

Prev: Study Plan for the RMP Certification

Next: Risk Communication

Chapter 54: Performing Quantitative Analysis

Though we have done the Qualitative Analysis in the previous chapter, we are not complete. We still need to do Quantitative Analysis.

Quantitative risk analysis is generally performed on risks that have been prioritized by using the qualitative risk analysis. However, depending upon the experience of the team and their familiarity with the risk, it is possible to skip the qualitative risk analysis and, after the risk identification, move directly to the quantitative risk analysis. The quantitative risk analysis has three major goals:

• Assess the probabilities of achieving specific project objectives
• Quantify the effect of the risks on the overall project objectives
• Prioritize risks by their contributions to the overall project risk

The image below explains the process more clearly.

Input to Quantitative Analysis

All the items that are input for the qualitative risk analysis are also input for the quantitative risk analysis. In addition, the quantitative risk analysis generally requires more information than its qualitative counterpart. The list of inputs for this process are:
• Risk register - The key input items from the risk register are the following:

o List of identified risks
o Priority list of risks if the qualitative risk analysis was performed
o Risks with categories assigned to them
o Management plans - To perform quantitative risk analysis, you must look at the risk management plan, cost management plan, and schedule management plan. To generate the output of the quantitative risk analysis, you need the following elements of the risk management plan:

 Budgeting
 Definitions of probabilities and impacts
 Probability and impact matrix
 Risk categories
 Risk timing and scheduling

To analyze the effect of risks on the project objectives, you need to know the project schedule and the project cost. These can be found in the cost management plan and schedule management plan. Also, the approaches taken by these plans can affect quantitative risk analysis.
• Organizational process assets - The following organizational process assets might be useful in the quantitative analysis:

o Information on previously performed similar projects
o Studies performed by risk specialists on similar projects
o Proprietary risk databases or risk databases available from the industry

Tools and Techniques for Quantitative Analysis

The quantitative risk analysis can be looked upon as a two-step process; gathering and representing the data, and analyzing and modeling the data. Accordingly, all the techniques fall into two categories: data gathering and representation techniques, such as interviewing, probability distributions, and expert judgment; and analysis and modeling techniques, such as sensitivity analysis, EMV analysis, decision tree analysis, and modeling and simulation. We shall be covering them one by one in the list below:

Interviewing - This technique is used to collect the data for assessing the probabilities of achieving specific project objectives. You are looking for results such as: We have a 70% probability of finishing the project within the schedule desired by the customer. Or: We have a 60% probability of finishing the project within the budget of Rs. 100,000. The goal is to determine the scale of probabilities for a given objective; for example, there is a 20% probability that the project will cost Rs. 50,000, a 60% probability that it will cost Rs. 100,000, and a 20% probability that it will cost Rs. 150,000.

The data is collected by interviewing relevant stakeholders and subject matter experts. Most commonly, you will be exploring the optimistic (best case), pessimistic (worst case), and most likely scenarios for a given objective.

Probability distributions - After you have collected the data on meeting the project objectives, you can present it in a probability distribution for each objective under study. Note that a distribution represents uncertainty, and uncertainty represents risk. For example, if you know for sure the project will cost Rs. 25 lakhs, there will be no distribution because it is only one data point. Distribution comes into the picture when you have several possible values with a probability assigned to each value. There are distributions of different shapes in which the data can be presented.

Look at the picture above. This example is for the cost objective. The X axis represents the cost, and the Y axis represents the corresponding probability that the project will be completed within that cost.

The beta distribution and the triangular distribution are the most frequently used distributions. The other commonly used distributions that could be suitable under given circumstances are normal distribution and uniform distribution. The uniform distribution is used when all the values of an objective have the same chance of being true.

Sensitivity analysis - This is a technique used to determine which risk has the greatest impact on the project. You study the impact of one uncertain element on a project objective by keeping all other uncertain elements fixed at their baseline values. You can repeat this analysis for several objectives, one at a time. You can also repeat this study for several uncertain elements (creating risks), one element at a time. This way, you can see the impact of each element (or risk) on the overall project separate from other elements (or risks).

Expected monetary value analysis - The expected monetary value (EMV) analysis is used to calculate the expected value of an outcome when different possible scenarios exist for different values of the outcome with some probabilities assigned to them. The goal here is to calculate the expected final result of a probabilistic situation. EMV is calculated by multiplying the value of each possible outcome by the probability of its occurrence and adding the results. For example, if there is 60% probability that an opportunity will earn you Rs. 1,000 and a 40% probability that it will only earn you Rs. 500, the EMV is calculated as follows:

EMV = 0.60×1000 + 0.40×500 = 600 + 200= 800

So the EMV in this case is Rs. 800. When you are using opportunities and threats in the same calculation, you should express EMV for an opportunity as a positive value and EMV for a threat as a negative value. For example, if there is a 60% chance that you will benefit from a risk by Rs. 1,000 and a 40% probability that you will lose Rs. 500 as a result of this risk, the EMV is calculated as follows:

EMV = 0.60×1000 - 0.40×500 = 600 – 200 = 400

Therefore, the EMV in this case is Rs. 400.

The concept of EMV can be presented in a decision-making technique, such as a decision tree analysis.

Decision tree analysis - This technique uses the decision tree diagram to choose from different available options; each option is represented by a branch of the tree. This technique is used when there are multiple possible outcomes with different threats or opportunities with certain probabilities assigned to them. EMV analysis is done along each branch, which helps to make a decision about which option to choose.

Look at the image below. It is a simple decision tree.

The decision tree diagram above depicts two options: updating an existing product or building a new product from scratch. The initial cost for the update option is Rs. 500,000, whereas the initial cost for the build-from-scratch option is Rs. 700,000. However, the probability for failure is 25% for the update option, compared to 10% for the build-from-scratch option, and the impact from failure for case 1 is Rs. 1.25 lakhs whereas for the other it is only Rs. 70,000. In such a situation, the build from scratch may be chosen because, even though it costs more, the chances of failure as well as losses in case of a failure are lower than the update option.

Modeling and simulation - A model is a set of rules to describe how something works; it takes input and makes predictions as output. The rules might include formulas and functions based on facts, assumptions, or both. A simulation is any analytical method used to imitate a real-life system. Simulations in risk analysis are created using the Monte Carlo technique, which is named after the city of Monte Carlo; known for its casinos that present games of chance based on random behavior. Monte Carlo simulation models take random input iteratively to generate output for certain quantities as predictions. This technique is used in several disciplines, such as physics and biology, in addition to project management. In risk analysis, the input is taken randomly from a probability distribution, and the output for impact on the project objectives is predicted. The name “Monte Carlo” refers to the random behavior of the input.
Expert judgment - In quantitative risk analysis, expert judgment can be used to validate the collected risk data and the analysis used for the project at hand.

Output of the Quantitative Risk Analysis: Updated Risk Register

As with the Qualitative Analysis, the output of this process too is the updates to the Risk Register. The updates include:
• Probabilistic analysis of the project - This includes the estimates of the project schedule and cost with a confidence level attached to each estimate. Confidence level is expressed in percentage form, such as 95%, and it represents how certain you are about the estimate. You can compare these estimates to the stakeholders’ risk tolerances to see whether the project is within the acceptable limits.
• Probability of achieving the project objectives - Factoring in project risks, you can estimate the probability of meeting project objectives, such as cost and schedule, set forth by the current project plan. For example, the likelihood of completing the project within the current budget plan of Rs. 2 lakhs is 70%.
• Prioritized list of risks - Risks are prioritized according to the threats they pose or the opportunities they offer. Risks with greater threats (or opportunities) are higher on the list. The goal is to prioritize the response plan efforts to eliminate (or minimize) the impact of the threats and capitalize on the opportunities. The priorities are determined based on the total effect of each risk to the overall project objectives.
• Trends in the results - By repeating the analysis several times and examining the results, you might recognize a trend for specific risks. That trend might suggest further analysis or a specific risk response. In finding the trend, you can also take a look at the historical information on project cost, quality, schedule, and performance.

Prev: Performing Qualitative Analysis

Next: Planning Risk Response

Chapter 53: Performing Qualitative Analysis

Qualitative Analysis is the first step towards analyzing the risks that have been identified in the risk identification process. The qualitative analysis process is quick and cheaper. It gives you some feel about the risks, and then you can determine which risks needs to be analyzed further by using quantitative analysis.

The perform qualitative risk analysis process is shown as a picture below:

Input to Qualitative Risk Analysis

The Risk Register is a default input to this process. Apart from the risk register, the other inputs to this process are:

Project scope statement - When you are performing qualitative risk analysis, you want to know what kinds of risks you are dealing with. For example, are you already familiar with these risks? If your project is similar to previous projects, it might have well-understood risks. If it is a new and complex project, it might involve risks that are not well understood in your organization. So, how do you know what kind of project you are dealing with? Simply put, you have to take a look at the project scope statement and search for uncertainties.
Risk management plan - To generate the output of qualitative risk analysis, you will need the following elements of the risk management plan:

• Roles and responsibilities for performing risk management
• Budgeting
• Definitions of probabilities and impacts
• The probability and impact matrices
• Risk categories
• Risk timing and scheduling
• Stakeholders’ risk tolerances

If any of these input items was not developed during risk management planning, it can be developed during qualitative analysis.

Risk register - The risk register contains the list of identified risks that will be the key input to the qualitative risk analysis. Updated risk categories and causes of risks can also be useful elements of the risk register, which can be used in the qualitative risk analysis.
Organizational process assets - While analyzing risks, you will make use of the risk-related components of the knowledge base from previous projects, such as data about risks and lessons learned. You can also look into risk databases that may be available from industry organizations and proprietary sources.

Tools and Techniques for Qualitative Risk Analysis

Prioritizing risks based on their probability of occurrence and their impact if they do occur is the central goal of qualitative risk analysis. Accordingly, most of the tools and techniques used involve estimating probability and impact.

Risk probability and impact assessment - Risk probability refers to the likelihood that a risk will occur, and impact refers to the effect the risk will have on a project objective if it occurs. The probability for each risk and the impact of each risk on project objectives, such as cost, quality, scope, and time, must be assessed. Note that probability and impact are assessed for each identified risk.

Methods used in making the probability and impact assessment include holding meetings, interviewing, considering expert judgment, and using an information base from previous projects.

A risk with a high probability might have a very low impact, and a risk with a low probability might have a very high impact. To prioritize the risks, you need to look at both probability and impact.

Assessment of the risk data quality - Qualitative risk analysis is performed to analyze the risk data to prioritize risks. However, before you do it, you must examine the risk data for its quality, which is crucial because the credibility of the results of qualitative risk analysis depend upon the quality of the risk data. If the quality of the risk data is found to be unacceptable, you might decide to gather better quality data. The technique to assess the risk data quality involves examining the accuracy, reliability, and integrity of the data and also examining how good that data is relevant to the specific risk and project for which it is being used.

Risk urgency assessment - This is a risk prioritization technique based on time urgency. For example, a risk that is going to occur now is more urgent to address than a risk that might occur a few months from now.

Probability and impact matrix - Risks need to be prioritized for quantitative analysis, response planning, or both. The prioritization can be performed by using a probability and impact matrix; a lookup table that can be used to rate a risk based on where it falls both on the probability scale and on the impact scale.

Look at the table below: RXY, where X and Y are integers that represent risks in the two-dimensional (probability and impact) space.

Probability	Impact
0.00	0.05	0.15	0.25	0.35	0.45	0.55	0.65	0.75	0.90
0.20	R11	R12	R13	R14	R15	R16	R17	R18	R19
0.40	R21	R22	R23	R24	R25	R26	R27	R28	R29
0.60	R31	R32	R33	R34	R35	R36	R37	R38	R39
0.80	R41	R42	R43	R44	R45	R46	R47	R48	R49

This is how you read this matrix. R21 has a 40% probability of occurring and will have a 5% impact on the project. Similarly R49 has a 80% probability and will have a 90% impact on the project.

How to calculate the numerical scales for the probability and impact matrix and what they mean depends upon the project and the organization. However, remember the relative meaning: Higher value of a risk on the probability scale means greater likelihood of risk occurrence, and higher value on the impact scale means greater effect on the project objectives.

Each risk is rated (prioritized) according to the probability and the impact value assigned to it separately for each objective. Generally, you can divide the matrix in the table above into three areas; high-priority risks represented by higher numbers, such as R49, medium-priority risks represented by moderate numbers, such as R25, and low-priority risks represented by lower numbers, such as R12. However, each organization has to design its own risk score and risk threshold to guide the risk response plan.

Note that impact can be a threat (a negative effect) or an opportunity (a positive effect). You will have separate matrices for threats and opportunities. Threats in the high-priority area might require priority actions and aggressive responses. Also, you will want to capitalize on those opportunities in the high-priority area, which you can do with relatively little effort. Risks posing threats in the low-priority area might not need any response, but they must be kept on the watch list to ensure that you don't get any unwanted or unexpected surprises towards the end of the project.

Risk categorization - You defined the risk categories during the risk management planning and risk identification processes. Now you can assign the identified risks to those categories. You can also revisit the categorization scheme, such as RBS, that you developed for your project, because now you have more information about risks for the project. Categorizing risks by their causes often helps you develop effective risk responses.

Expert judgment - You may need expert judgment to assess the probability and impact of each risk. To find an expert, look for people who’ve had experience with similar projects in the not too distant past. While weighing the expert judgment, look for possible biases. Often experts are biased toward their area or idea.

Output of the Qualitative Risk Analysis: Updated Risk Register

The risk register was initiated during the Identify Risks process and is updated with the results from the qualitative risk analysis. The updates will be:
• Risks categorizations - This means arranging risks in different categories. This helps you identify the common root causes of the risks and the areas of the project that might require special attention. Furthermore, categorizing risks can bring order to a chaotic situation and makes the management of these risks easier and more effective.
• Prioritized list of risks - The risk register has lists of risks prioritized according to the probability and impact matrix discussed earlier in this article. A separate list can be created for each project objective, such as cost, quality, scope, and time. These lists help you prioritize efforts for preparing and executing risk responses. The risks may be ranked as high, medium, or low.
• Lists of risks - Using some criteria, you can make different lists of risks for effective management. Following are some examples:

o List of risks with time urgency - This list includes urgent risks that require attention now or in the near future.
o Watch list of low-priority risks - This list contains risks that are deemed unimportant by the qualitative risk analysis but that need to be monitored continually.
o List of risks for additional analysis and response - This list includes risks that need further analysis, such as quantitative analysis or a response action.

• Trends in the analysis results - By examining the results from the qualitative risk analysis, you might recognize a trend for specific risks. That trend might suggest further analysis or a specific risk response.

The main output of qualitative risk analysis is the prioritization of risks based on a probability and impact matrix for each objective. So each objective can have its own prioritized list of risks.

Qualitative risk analysis is a relatively quick and cost-effective way to prioritize risks for risk planning. It also lays the groundwork for the quantitative risk analysis if one is required for some of the identified risks.

Prev: Analyzing Risks

Next: Performing Quantitative Analysis

Chapter 52: Analyzing Risks

In the previous chapter, we learnt how to identify risks. Identifying risks is a big task and if we screw up this step, the results can be disastrous. However, if we follow all the guidelines as explained in the PMBOK, we can be certain that our risk identification process was done efficiently. The next step for us is to analyze these risks. We are going to learn exactly that in this chapter.

So, lets get started!!!

Analyzing Risks

Once the risks have been identified, you need to answer two main questions for each identified risk:

1. What are the odds that the risk will occur,
2. If it does occur, what will its impact be on the project objectives?

You get the answers by performing risk analysis.

There are two main forms of Risk Analysis:

1. Qualitative Risk Analysis &
2. Quantitative Risk Analysis

Qualitative Risk Analysis

This is used to prioritize risks by estimating the probability of the occurrence of a risk and its impact on the project.

Quantitative Risk Analysis

This is used to perform numerical analysis to estimate the effect of each identified risk on the overall project objectives and deliverables.

Usually, you prioritize risks by performing qualitative analysis on them before you perform quantitative analysis. We will learn both one by one in the subsequent chapters.

Prev: Identifying Risks

Next: Performing Qualitative Analysis