Risk analysis and management are important skills to practice. They help reduce surprises and uncertainties that can negatively impact your project’s scope, schedule, performance, or budget. Risk is not just about threats. Project management risk analysis also identifies opportunities to reduce project cost or time.
Analyzing Project Risk
A good risk management plan identifies, analyzes, manages, and closes out risks during each project phase before they become real issues. This allows you evaluate the likelihood and impact that a risk will emerge during a project.
Project Management risk analysis begins with qualitative methods to examine, rank, and score the risk events. Once identified risks are sorted and prioritized. Higher priority threats and opportunities are focused. For more detailed risk analysis requires quantitative techniques which are not discussed in this article.
What is Qualitative Risk Management?
Here is an overview of qualitative risk management:
1. Risk Tolerance: Decide the level of risk that is acceptable. The level of tolerance you have for risk will determine the amount of risk you are willing to take on in your project. Risk tolerance tends to be subjective however, in determining your risk tolerance you should consider past projects and how risks taken on during them played out.
2. Identify Opportunities and Threats: Two tools that are useful for identifying risks are Risk Categories and Risk Breakdown Structure. Risk Categories separate different risks based on their common characteristics. For example, one category could be natural disasters. Another category could be market or interprets rate fluctuations. Risk Breakdown structure is a process where large risks categories are broken down into smaller packages. To take the above example, interest rate fluctuations of 5 percentage points will require a certain risk response while a 50% change would require an entirely different response. One thing to keep in mind is that risks can also be opportunities, like a key commodity used in your project is available at a lower price thus reducing overall project cost.
3. Qualitative Risk Analysis: Qualitative analysis is a subjective analysis to estimate probability and value for each risk. One way of doing this is to use a risk matrix. The risk matrix allows you to rank each and its potential effect on the project resulting in a ranking within the context of the project. Ultimately this will allow you to determine the overall risk for the entire project. The rankings will also allow you to prioritize risks within the project.
4. Quantitative Risk Analysis: This process is optional because not all projects and not all risks need this level of analysis. Big, strategically important projects would be more likely to need quantitative risk analysis. For example, you might need the probability that there will be a concrete shortage during a road building project or a shortage of processors from a third-party country as the result of strike or factory closure. There are mathematical tools for doing this kind of risk analysis, but they are beyond the scope of this article.
5. Strategies for Higher Ranked Risks: Simply put, the higher ranked the risk, the more likely that you need a contingency plan for dealing with it.
6. Follow the Contingency Plan: If a risk occurs then the contingency plan for that risk should be followed. These contingency plans act as a roadmap for the team to follow.
7. Evaluate and Analyze if Risk Management is Working: You have to watch, evaluate and determine if the risk efforts that you planned are working. If not, you need a reassessment of the risks to identify necessary changes in your plans for the risks.
Qualitative Risk Analysis Process
Qualitative Risk Analysis allows you determine which risks warrant a response. You’ll need to establish evaluation criteria to avoid putting your energies in the wrong place. You also need to make sure that your subject matter experts that are participating in the evaluation are using the same criteria for consistency. (See item 1 below for examples and watch for our next blog for more information on the establishing these criteria.)
A common error encountered is not focusing our efforts on the highest value risks to generate the best results. Having a qualitative risk analysis process can be help, here is one you can use:
1. Subjectively evaluate the probability and impact of each risk: Using a matrix (1-5 scale, high medium, low) allows you to be able to have consistent criteria used in that evaluation.
2. Create a shorter list of risks: This allows you to create a smaller set of risks you are working on and a watch list of the ones, that if they occur, are not going to have significant impact on your schedule, budget, or resources and you can absorb that small impact to the project.
3. Determine the top or critical risks you will quantify and/or will require a response plan: This short list is prioritized by the risk’s qualitative ranking and is used to decide what to do next. For large/high priority projects, quantitative risk analysis can give further prioritization to the short list. For other projects that are smaller or are not as high in the organization’s priorities you can go directly to employing risk strategies and creating contingency plans.
4. Make a go/no-go decision: Consider creating an overall risk rating for the project to determine if the project is within acceptable risk levels for your organization. This ranking can be helpful in making a go/no-go decision. It will help answer the question: “After evaluating the risks, do you still want to do this project?”
Why Qualitative Risk Analysis is Important?
As you look at next steps and how to proceed about the risk, qualitative analysis of risk is critical to make sure that you are doing work in the right way at the right time.
You would proceed to Quantitative Risk Analysis if:
- You identified all the project risks
- It is worth the time and money
- It has high priority or visible project
- There is a low tolerance for cost or schedule overruns
- You possess tools and capabilities
You would proceed to Risk Response Planning if:
- The project has a smaller budget or is shorter project
- You are new to risk management and have yet not developed your risk analysis skills
- There are a small number of risks
- The risk ratings identified warrant moving directly to response strategies
Passively Accepting Risk: Watch list
When you reach the threshold where you need to address the risks identified, using a watch list is the way of tracking the identified risks that you can passively accept.
Table 1 Risk Register Example from Rita Mulcahy’s™ Risk Management Tricks of the Trade® for Project Managers, 3rd Edition
Page 138, Fig 5.13
All risks will be documented in the risk register. Their score will be compared to the risk threshold and those under it will be ranked lower and will make up the watch list within the risk register. These low priority risks do not move forward in the risk management process as they do not require quantitative risk analysis or response strategies. Risks that need to be addressed will rank higher and continue through process and the additional documentation is added to the to the risk register.
Table 2: Risk Register with additional columns for documentation for short list risks
Learn More About Project Managent Risk Analysis
Need real-world, step by step approach to using Risk Management in your current projects to help minimize the occurrence and impact of project risks?
RMC offers a variety of ways to improve your risk management skills including Rita Mulcahy’s Risk Management Tricks of the Trade for Project Managers eLearning course, Instructor-led virtual or book. You can also listen to our recorded webinar Five Tips for Easy Qualitative Risk Analysis and earn 1 free PDU.
Sources:
https://projectriskcoach.com/evaluating-risks-using-quantitative-risk-analysis/
- Scope Management for Agile, Hybrid or Predictive - June 7, 2023
- Project Scope and Business Environment Impact - June 8, 2022
- What Makes an eLearning Course “Good”? - March 30, 2022
