Or as Dan Quayle said: “If we don’t succeed we run the risk of failure!”
Qualitative Risk Analysis is the method used by the vast majority of projects to prioritize risk, and it leverages its two components:
Probability – how likely is the event to occur
Impact – what will happen if the event occurs
Qualitative Risk Analysis is designed to assign relative weighting to identified risks and group them together logically so that response strategies can be developed and applied.
The Project Manager (PM) is not a subject matter expert – they are a process expert. This is why establishing governance over all processes in the Planning Phase is crucial. The decision to use Qualitative Risk Analysis and the supporting processes should have been documented at that time.
It is also important to remember that for the PM, risk presents as variance from the plan – both positive and negative. If your project comes in dramatically under budget and ahead of schedule, that is also a “failure”! The resources and time allocated to your project weren’t accurate and could have been deployed elsewhere.
That can have significant organizational impact.
So how does Qualitative Risk Analysis work??
As risks are identified they are assigned to experts for assessment. How to “score” the risks is described in the Risk Assessment Matrix which. The Y-axis lists those items of strategic importance and typically include scope, cost, schedule and quality – however I have seen items like “reputation” and “regulatory” also be included. The X-axis contains the PM’s guidance on how to weight probability and impact so that the agreed upon view of risk is reflected in the analysis.
This isn’t difficult at all! You look at a risk and determine that it would have an impact on the schedule. You know that “schedule” is important as a strategic priority, so you assign it to the experts best able to assess the impact. They score it based on the criteria you provided them Risk Assessment Matrix. That’s it!
The Risk Assessment Matrix is a crucial tool to compensate for the risk/reward bias described in the Utility Theory. Click here for a deeper discussion of that topic:
https://www.projectmanagementforum.net/single-post/2017/07/05/What-is-Project-Risk-Part-1
There are many examples of how to do this on the internet, so chose the format that works best for your organization.
The identified risks have now been “scored” by the experts based on the guidance you provided. The next step is to array them on a Probability and Impact Matrix. Here is an example:
Surce PMBOK® Guide, page 331, figure 11-10
Risks are placed into 4 broad categories based on their scores. Looking at the chart above, you can see the risks that score in the top right have the greatest probability of occurring and have the greatest impact, while those in the bottom left have the least chance of occurring and the smallest impact. The 4 broad categories are:
High probability, high impact – it probably will occur and it will be awful
High probability, low impact – it will probably occur, but it won’t be too bad
Low probability, high impact – it probably won’t occur, but if it does it will be awful
Low probability, low impact – it probably won’t occur, and if it does it won’t be too bad
Placing risk into these categories is important because there are specific response strategies for each grouping. I have been asked many times “what is your mitigation strategy?”. Mitigation is not the proper response to every type of risk! I will cover this in a later post.
Please note that the chart above only represents ½ of the total matrix and focuses on negative risk, while the PM should also be on the lookout for exploitable opportunities! Remember, for the PM risk really about variance from the Project Plan.
The benefits of Qualitative Risk Analysis are that it is intuitive and most organizations use it! Anyone who has watched a meteorologist describe the path of a hurricane can understand this process. It also provides a great basis for initial risk assessment and is often what is intuitively used in the early phases of the project.
There are three key weaknesses.
Like all estimates it is still an educated guess based on expert opinion. Is there a 10% chance or a 20% chance? Hard to pin that down!
The output (the categories above) don’t support more sophisticated computer modeling.
It doesn’t provide you with a monetary value of the impact, so there needs to be a secondary analysis to determine how much “high impact” could cost you!
Quantitative Risk Analysis solves two of those problems, and we will discuss that next time.