Quantitative risk analysis

Quantitative risk analysis is one of approaches to project risk assessment. The second is qualitative risk analysis. It can be used also to other areas of management, not only projects. It is important to state that both approaches are complementary. Usually all risks should be evaluated using qualitative risk analysis, while only some of them using quantitative one. The latter requires more data and more time, which sometimes are not available or they cost too much.

How to use quantitative risk analysis

Quantitative risk analysis methods are based on numbers which express level of risk. They seem to be more precise, as they use numerical data, however it is not always true. Reliability of those methods cannot be higher than reliability of data.

Quantitative methods are easier to automate using software. Nowadays applications are able to gather data from predefined locations (web, machines, facilities, reports, etc.) and generate quite advanced analyses. This helps reduce the main problem of those methods - workload required to use them.

Quantitative risk analysis is used mainly in finance, but it has also great application in projects, information security and quality. However, in those areas qualitative methods become more and more popular.

Methods of quantitative risk analysis

There are plenty of methods of quantitative or semi-quantitative risk analysis. Table 1 shows categorisation of methods in five main groups:

• Statistical,
• Mathematical,
• Scenario-based,
• Graphical,
• Expert.

Some of methods are so extensive, that could fall into two or more groups. In that case they were put into group they fit the best. Some methods are described in detail in other articles on our website.

Table 1. Categorisation of quantitative risk analysis methods

Statistical methods	Simple probabilistic risk management Multi-criteria decision analysis Monte Carlo Bayesian statistics Bayesian nets
Mathematical methods	Interval analysis Thresholds Sensitivity analysis Markov analysis
Scenario-based methods	Scenario analysis Uncertainty decision rules Environmental risk assessment Failure Mode and Effects Analysis Reliability centered maintenance
Graphical methods	Models (model building) Event trees Fault tree analysis Root cause analysis Cause consequence analysis Cause and effect analysis Bow tie analysis Frequency number curves
Expert methods	Subjective probability elicitation Safety assessment Vulnerability assessment Layers of protection analysis Human reliability assessment Risk control effectiveness Cost benefit analysis

Issues of risk analysis

The risk analysis has some limitations and unsolved problems that should be known by decision-makers in order to avoid bad decisions based on risk analyses.

1. Level of aggregation of source data (e.g. costs, tasks). The higher the aggregation of source data, the less precise is result. However, in case of low or no aggregation amount of work is considerably higher, which can lead to shallow analysis.
2. Elicitation of probabilities. In case of well known risk factors organization has historical data and is able to determine probability. But new factors come without historical data. The problem can be solved using extensive expert estimation and some statistical methods, e.g. Bayesian analysis.
3. Correlations. Tasks that are related to each other (e.g. the same people, hardware) can behave as correlated in case of risk. This requires using multivariate distribution in probability analysis instead of univariate. This however leads to high sophistication of analysis and therefore is not used in most cases.
4. Feedback effects. Managers use adaptive strategies to reduce problems of slipping schedule of costs. This leads to changes in original assumptions. It is not possible to determine such events, as this would require more skills and efforts than prevent them in the first place.
5. There's not enough data. Risk management is based on insufficient data. If decision-maker has all the data required, there is no risk - there is certainty. In case of advanced technologies there can be so few data, that quantitative analysis is less precise than qualitative methods.

Differences between qualitative and quantitative risk analysis

Qualitative risk analysis is:

• oriented on risk level,
• uses subjective evaluation,
• is quicker and easier,
• no special software is required,
• it's less precise.

Quantitative risk analysis is:

• oriented on object (e.g. project, product, process),
• uses hard data - probabilistic estimates of costs, time, etc.,
• requires more time,
• may require specialised software, especially in large projects,
• tends to be more precise.

The decision is between being more precise vs. cost more and use more time.

Examples of Quantitative risk analysis

• Monte Carlo Simulation: It is a method used to analyze the potential impact of risk on a project. It uses random sampling to generate multiple possible outcomes for a project based on the impact of risk. For example, a project manager could use Monte Carlo Simulation to estimate the total cost of a project, taking into account the potential impact of risk on cost.
• Expected Monetary Value (EMV) Analysis: It is a technique used to assess the cost of a risk event. It involves estimating the probability of occurrence of the risk event and assigning a monetary value to the event. For example, a project manager could use EMV Analysis to calculate the expected cost of a project, taking into account the cost of a potential risk event.
• Decision Tree Analysis: It is a technique used to assess the cost of alternative decision paths. It involves estimating the probability of occurrence of different events, and assigning a monetary value to different decision paths. For example, a project manager could use Decision Tree Analysis to compare the total cost of different project options, taking into account the cost of different potential risk events.

Advantages of Quantitative risk analysis

Quantitative risk analysis is an important tool for evaluating risks and making decisions in project management. The following are the benefits of using this approach:

• Quantitative risk analysis allows a systematic approach to decision-making. It takes into account all possible risks, their probability of occurring, and their potential impact on the project. This helps to identify the most critical risks and prioritize them for mitigation or management.
• Quantitative risk analysis helps to create a realistic view of the project's future. It considers both the likelihood and severity of the risks and provides a quantitative measure of the risk profile of the project. This helps to identify areas that require more attention or changes in strategy.
• Quantitative risk analysis helps to identify cost and schedule overruns before they occur. This allows for early corrective action and cost savings in the long run.
• Quantitative risk analysis helps to set up contingency plans that can help reduce the impact of risks on the project. It can also help to identify additional resources that are needed to manage the risk.

Limitations of Quantitative risk analysis

Quantitative risk analysis is a useful tool for assessing project risks, but it has certain limitations.

• Quantitative risk analysis requires a substantial amount of data, which may be difficult to acquire.
• Quantitative risk analysis requires a high level of accuracy, making it difficult to use with incomplete or inexact data.
• Quantitative risk analysis is time consuming, as it requires the collection and analysis of data, which can be costly.
• Quantitative risk analysis may not be appropriate for all types of risks, as it is mainly suitable for assessing risks with measurable outcomes.
• Quantitative risk analysis may be based on certain assumptions, which may change over time, making the results of the analysis inaccurate.

Other approaches related to Quantitative risk analysis

Quantitative risk analysis is not the only approach to risk assessment. Other well-known approaches include:

• Risk Management - It is a systematic process of identifying, analyzing and responding to risks in order to minimize potential negative consequences. It involves identifying, analyzing, and responding to risks to ensure they are managed appropriately.
• Decision Analysis - It involves assessing the potential outcomes of a decision or a set of decisions. It helps to identify and quantify risks and understand the impact of these risks on the expected outcome.
• Scenario Analysis - It is a tool used to evaluate the potential outcomes of a decision or a set of decisions based on different possible future scenarios. It can be used to identify potential risks and make decisions about how to manage them.

In summary, Quantitative risk analysis is one of many approaches that can be used to assess risks. Other approaches include Risk Management, Decision Analysis and Scenario Analysis. Each approach has its own advantages and disadvantages, and it is important to choose the approach that best fits the situation.

Quantitative risk analysis — recommended articles

Qualitative risk analysis — Conditions of decision-making — Failure Mode and Effects Analysis — Rational decision making — Evaluation of risk — Risk evaluation — Central tendency error — Decision tree — Maintenance strategy

References

• List of methods of quantitative risk analysis, US Army Corps of Engineers, online course
• Galway L. (2004). Quantitative Risk Analysis for Project Management, RAND WR-112-RC, February
• Embrechts, P., Frey, R., & McNeil, A. (2005). Quantitative risk management. Princeton Series in Finance, Princeton, 10.

Author: Slawomir Wawak