Section Summary – Qualitative Risk Analysis

In the previous few chapters in this section, we took a detailed look at what qualitative risk analysis is, the inputs that are required to perform this analysis and the tools & techniques that we will be using during this analysis. Let us now quickly summarize what we have learnt in this section so far:

• The purpose of qualitative risk analysis process is to prioritize risks in order to determine which risks require additional analysis. This helps the risk management team to focus on the higher priority risks.
• There are 4 inputs to this process:

o Risk Register
o Risk Management Plan
o Project Scope Statement &
o Organizational Process Assets

• There are a total of 6 tools & techniques that we learnt in this section. They are:

1. Risk Probability & Impact Assessment
2. Probability & Impact Matrix
3. Risk Data Quality Assessment
4. Risk Categorization
5. Risk Urgency Assessment
6. Expert Judgment

• Risk Probability & Impact Assessment provides us with the initial risk rating for each of the risks that we have identified so far. To arrive at this risk rating, we will be using the definition of risk probability and impact that we defined when the Risk Management Plan was created
• The Risk Probability & Impact Matrix is used to assign a risk score to our risk and categorize it as “High-Medium-Low” priority
• Risk Data quality Assessment focuses on making sure that the information we are using to perform the risk analysis activities is unbiased and credible. This is because; conducting risk analysis using poor quality data may result in results that are useless. Frankly speaking, if we cannot trust our data or information, how can we trust the findings that were made based on that data or information?
• The idea of Risk Categorization is to uncover areas of risk concentration so that we can create effective responses to handle them. This is because; dealing with sources of risks is easier and cost effective than dealing with each risk individually. In fact, it can have a greater level of effectiveness as well
• The purpose of this risk urgency assessment technique is to identify near term risks. We are trying to determine which risks are to be considered urgent. In other words, we are trying to identify those risks that require our immediate attention
• Expert Judgment refers to the decisions or suggestions given by knowledgeable experts during the various activities in qualitative risk analysis. The individuals who provide us with their expert judgment are called as “Experts”

By now you should have a very good idea and understanding of the Qualitative Risk Analysis process. To wrap up this section you need to:
• Remember what tools are used in this process
• Remember what each tool does and produces
• Understand that not all tools are used in each process

Trivia:

Are you wondering that I haven’t touched upon the topic of what is the output of this whole Qualitative Risk Analysis process? If you did then you deserve a big pat on the back. Every process creates some sort of output and our Qualitative risk analysis is no different. But, I haven’t covered it in this section because; the whole of the next section is going to be dedicated just to cover that.

If you did not think about the output of this process, no worries. Just brush up your PMBOK basics and re-read some of the initial chapters to refresh your memory and you will be on your way to being a Risk Management Professional.

Prev: Expert Judgment

Next: Updates to Risk Register after Qualitative Analysis

Risk Categorization

We have covered three of the tools and techniques used in qualitative risk analysis; namely - Risk Probability & Impact Assessment, Probability & Impact Matrix and Risk Data Quality Assessment. The next item in the list is “Risk Categorization” which we are going to learn in this chapter.

Risk Categorization

Imagine how effective our project’s risk management efforts could be if we can pin-point what areas of our project are most affected by risks? What if we know the areas of the Work Breakdown Structure WBS that are sources of multiple risks or what if we know which project phase carries the highest level of risk?

The answer to all these questions will be “Very Good” isn’t it?

The idea of Risk Categorization is to uncover areas of risk concentration so that we can create effective responses to handle them. This is because; dealing with sources of risks is easier and cost effective than dealing with each risk individually. In fact, it can have a greater level of effectiveness as well.

We can categorize risks by source using either of the following:

1. Risk Breakdown Structure – RBS
2. Work Breakdown Structure - WBS and
3. Project Phases

If you are not too sure about what this activity is all about, let’s go back to our F1 track construction example.

Let us say that during risk identification, we have identified several high priority/impact risk items related to the equipment we will be using to lay the race track. So, if we categorize these risks, the company that is supplying these machines could be a potential source of risk. The quality of machines they supply, the availability of those machines, servicing delays in case the machines breakdown during track laying activity etc. could be potential risks that we will be exposing ourselves to when we lease or rent these machines from the company.

What if we do some analysis and find out that buying those machines ourselves could cost us a bit more than what the rental company is charging us but it could eliminate all of the risks above because we know that the machine we are buying is of good quality and will be available for our use anytime we want. Moreover, once this track is constructed, we can even re-use this machine in any subsequent tracks we may take up for construction. All in all, by grouping or categorizing a bunch of risks to its source, we have created a response that can help us handle all of those risks effectively in one shot.

Now, can you understand how useful this Risk Categorization activity is in creating effective risk responses?

Prev: Risk Data Quality Assessment

Next: Risk Urgency Assessment

Risk Categorization

As explained in the previous chapter, the distinction between risk categories and risk types is pretty blurred. The distinction you find in this blog is what the majority of the project management world goes with. However, don’t be surprised if your organization goes by a different yardstick when it comes to classifying or categorizing risks.

There are way too many categories of risks and as I said before, every company uses its own risk categorization standards. As per the PMBOK guide the term Risk Category refers to “A Group of Potential Causes of Risk”.

Why do Risk Categorization?

Did you think of this? Why go through the pain of categorizing these risks when we are anyways going to list them all down in the Risk Register and handle them?

The whole purpose of Risk Categorization is to systematically identify risks in a consistent manner and organize them so that they can be better managed. It also helps to identify the root causes of these risks in a better way. A Risk Breakdown Structure or RBS is a classic example of this Risk Categorization idea. The RBS splits risks into categories and then splits them further into sub-categories thereby making our lives (The life of a Risk Manager) easier.



The above is a sample RBS where we have classified the risks for a project into 3 broad categories:

a. Internal
b. External &
c. Project Management

Each of these categories has been further split into 3 sub-categories. A typical RBS can have as many categories & sub-categories as you want. The 3 above is just an example…

How to Proceed with Risk Categorization? – For New Project Managers:

If you are a new Project Manager or new to the Organization where you are managing your projects and are not too sure of how to proceed with this Risk Categorization exercise, don’t worry. Check out previous projects that were similar to yours from the archives and see how the categorization was done. Or you could check with commercial templates based on which industry you work on. Or even better, check with other PMs in your company and check how they completed this activity for their project. This way you will have enough information to proceed with and perform a good quality categorization…

Practically speaking, there is no master list of categories that you can use for your project. It changes from project to project, from industry to industry and most importantly as I have said numerous times before, from company to company. Nonetheless, to get you started in the right direction, below are some broad categories that can be used in a majority of the projects that you may encounter in your life. A word of caution here is that, the list below is not complete and only the starting point for you to improvise on…

1. Internal
2. External
3. Environmental
4. Economic
5. Political
6. Market
7. Process
8. Third-Party
9. Business
10. Operations
11. Organizational
12. Infrastructure
13. Culture
14. Technology
15. Human Resources
16. Legal
17. Financial
18. Project Management
19. Security
20. Etc.

Prev: Types of Risk

Next: Managing Uncertainty