Qualitative risk analysis

From CEOpedia | Management online
Qualitative risk analysis
See also

Qualitative risk analysis is one of approaches to project risk assessment. The second is quantitative risk analysis. It can be used also to other areas of management, not only projects. It is important to state that both approaches are complementary. Usually all risks should be evaluated using qualitative risk analysis, while only some of them using quantitative one. The latter requires more data and more time, which sometimes are not available or they cost too much.

Differences between qualitative and quantitative risk analysis

Qualitative risk analysis is:

  • oriented on risk level,
  • uses subjective evaluation,
  • is quicker and easier,
  • no special software is requi,
  • it's less precise.

Quantitative risk analysis is:

  • oriented on object (e.g. project, product, process),
  • uses hard data - probabilistic estimates of costs, time, etc.,
  • requires more time,
  • may require specialised software, especially in large projects,
  • tends to be more precise.

The decision is between being more precise vs. cost more and use more time.

How to use qualitative risk analysis

Not having hard data on likelihood and consequences, the risk management team has to assess how important risk factors are. Therefore, a pefined scale is used. The likelihood and consequences are described on the scale usually using 5 levels, however different configuration is possible. The risk level is result of combination of estimates of likelihood and consequences. The qualitative risk analysis should be followed by quantitative analysis of risks that are the most important. It should be repeated on different stages of the project to determine new information that can impact estimation of probability and impact. All levels should be well defined to reduce influence or bias.

Table 1. Example of qualitative risk assessment matrix

Probability Threats Opportunities
5 certain
4 likely
3 moderate
2 unlikely
1 rare
1 insignificant 2 minor 3 moderate 4 major 5 catastrophic 5 great 4 major 3 moderate 2 minor 1 insignificant

The risk analysis guides risk response. In case of high probability and impact, the response should have priority over other risks. The organization should not undertake a project if the risk level is too high and no response have been established. Available risk responses are described in separate article: Risk management strategies.

Qualitative risk analysis in standards

In Project Management Body of Knowledge (PMBoK) performing qualitative risk analysis is one of processes in Project Risk Management together with:

  • Plan Risk Management,
  • Identify Risks,
  • Perform Quantitative Risk Analysis,
  • Plan Risk Response,
  • Monitor and Control Risks.

The PMBoK indicates that risk can be assessed for each objective separately. But this can lead to repeating the same risks and underestimation of their impact or probability. Therefore, on some stage all the risks should be integrated in one catalogue, e.g. using spreadsheet.

The result of qualitative risk analysis should be:

  • the risk register updates,
  • ranking of risks,
  • identified causes of risks,
  • propositions of responses in short and long term,
  • watch-lists of low-priority risks,
  • trends.


Author: Slawomir Wawak