Qualitative risk analysis
|Qualitative risk analysis|
Qualitative risk analysis is one of approaches to project risk assessment. The second is quantitative risk analysis. It can be used also to other areas of management, not only projects. It is important to state that both approaches are complementary. Usually all risks should be evaluated using qualitative risk analysis, while only some of them using quantitative one. The latter requires more data and more time, which sometimes are not available or they cost too much.
Differences between qualitative and quantitative risk analysis
Qualitative risk analysis is:
- oriented on risk level,
- uses subjective evaluation,
- is quicker and easier,
- no special software is requi,
- it's less precise.
Quantitative risk analysis is:
- oriented on object (e.g. project, product, process),
- uses hard data - probabilistic estimates of costs, time, etc.,
- requires more time,
- may require specialised software, especially in large projects,
- tends to be more precise.
The decision is between being more precise vs. cost more and use more time.
How to use qualitative risk analysis
Not having hard data on likelihood and consequences, the risk management team has to assess how important risk factors are. Therefore, a pefined scale is used. The likelihood and consequences are described on the scale usually using 5 levels, however different configuration is possible. The risk level is result of combination of estimates of likelihood and consequences. The qualitative risk analysis should be followed by quantitative analysis of risks that are the most important. It should be repeated on different stages of the project to determine new information that can impact estimation of probability and impact. All levels should be well defined to reduce influence or bias.
Table 1. Example of qualitative risk assessment matrix
|1 insignificant||2 minor||3 moderate||4 major||5 catastrophic||5 great||4 major||3 moderate||2 minor||1 insignificant|
The risk analysis guides risk response. In case of high probability and impact, the response should have priority over other risks. The organization should not undertake a project if the risk level is too high and no response have been established. Available risk responses are described in separate article: Risk management strategies.
Qualitative risk analysis in standards
- Plan Risk Management,
- Identify Risks,
- Perform Quantitative Risk Analysis,
- Plan Risk Response,
- Monitor and Control Risks.
The PMBoK indicates that risk can be assessed for each objective separately. But this can lead to repeating the same risks and underestimation of their impact or probability. Therefore, on some stage all the risks should be integrated in one catalogue, e.g. using spreadsheet.
The result of qualitative risk analysis should be:
- the risk register updates,
- ranking of risks,
- identified causes of risks,
- propositions of responses in short and long term,
- watch-lists of low-priority risks,
- ISO 31000 - the ISO standard describes in detail risk management system
- Kindinger, J. P., & Darby, J. L. (2000, September). Risk factor analysis-a new qualitative risk management tool. In Proceedings of the project management institute annual seminars & symposium (p. 7-16).
- Fletcher, W. J. (2005). The application of qualitative risk assessment methodology to prioritize issues for fisheries management. ICES Journal of Marine Science: Journal du Conseil, 62(8), 1576-1587.
Author: Slawomir Wawak