Project Risk Management Module 5

Purpose of Qualitative Risk Assessment:

Overview: Qualitative Risk Analysis involves prioritizing project risks based on probability and
impact, determining necessary actions, and establishing a foundation for quantitative analysis
and risk response planning.

Performing Qualitative Risk Analysis:

1. Inputs:
 Project management plan
 Risk management plan
 Project documents
 Assumption log
 Risk register
 Stakeholder register
 Agreements
 Procurement documents
 Enterprise environmental factors
 Organizational process assets
2. Tools and Techniques:
 Expert Judgment: Leveraging expertise for risk assessment.
 Data Gathering (e.g., Interviews): Collecting information on identified risks.
 Data Analysis: Assessing risk data quality.
 Risk Probability and Impact Assessment: Evaluating the likelihood and
consequences of risks.
 Assessment of Other Risk Parameters: Considering additional risk factors.
 Interpersonal and Team Skills (e.g., Facilitation): Utilizing collaboration for
analysis.
 Risk Categorization: Grouping risks based on common characteristics.
 Data Representation: Presenting risk information effectively.
 Probability and Impact Matrix: Mapping risks on a matrix.
 Hierarchical Charts: Visualizing risk relationships.
 Meetings: Collaborative sessions for in-depth analysis.
3. Outputs:
 Project Document Updates: Reflecting changes in risk assessment.
 Assumption Log: Recording assumptions related to risks.
 Risk Register: Comprehensive documentation of identified risks.
 Risk Report: Detailed analysis and recommendations.
 Missing Issue Log: Identifying gaps in risk assessment.

Purpose:
  Prioritization: Identify high-priority risks.
 Decision Support: Support decision-making on risk responses.
 Foundation for Quantitative Analysis: Set the stage for more detailed quantitative
analysis.
 Documentation: Update project documents to reflect the evolving risk landscape.

Tools and Techniques for Qualitative Risk Assessment:

1. Probability/Impact Matrices:
o Description: Evaluate the likelihood and impact of identified risks to determine
their magnitude and priority.
o Application: Utilize matrices to categorize risks based on probability and impact
levels.
o Example: A matrix with impact (low, medium, high) on the x-axis and probability
(low, medium, high) on the y-axis.
2. Top Ten Risk Item Tracking:
o Description: Focus on monitoring and managing the top ten risks that pose the
most significant threats or opportunities.
o Application: Prioritize attention and resources on key risk items.
o Objective: Efficiently address the most critical risks.
3. Expert Judgment:
o Description: Leverage the expertise of individuals or groups for informed risk
assessment.
o Application: Rely on knowledgeable insights to evaluate risks.
o Consideration: Recognize that expert judgment introduces subjective elements.
4. Probability/Impact Chart:
o Description: Graphical representation plotting impact against probability to
visualize risk characteristics.
o Application: Facilitate a clear understanding of risk magnitudes.
o Example: Chart indicating risk levels based on probability and impact.
Bias in Qualitative Risk Analysis:
 Subjectivity: Qualitative risk assessments are subjective, influenced by the perceptions
and attitudes of the project team and stakeholders.
 Risk Attitudes: Explicitly identify and understand the risk attitudes of key participants.
 Perceptions: Recognize that bias may affect risk perceptions and judgments.

Data Gathering and Analysis:

 Data Gathering:
o Interviews: Structured or semi-structured interviews to gather data.
o Trust Environment: Create an environment of trust and confidentiality for
unbiased assessments.
 Data Analysis Techniques:
 o Risk Data Quality Assessment: Evaluate the quality of collected risk data.
o Risk Probability and Impact Assessment: Assess the likelihood and consequences
of risks.
o Assessment of Other Parameters: Consider additional factors in the risk analysis
process.

Risk Data Quality Assessment:

Purpose:
 Evaluation of Data Quality: Assess the accuracy and reliability of individual project risk
data.
 Impact: Low-quality risk data can compromise the effectiveness of qualitative risk
analysis.
Data Quality Characteristics:
1. Completeness:
o Definition: Presence of all necessary data.
o Assessment: Verify if all required data elements are available.
2. Validity:
o Definition: Conformity of data values to specified business criteria.
o Assessment: Ensure data values align with specified parameters.
3. Accuracy:
o Definition: Reflects real-world objects or verifiable sources.
o Assessment: Verify the authenticity and reliability of data.
4. Consistency:
o Definition: Uniformity of data across systems; absence of duplicate records.
o Assessment: Check for consistency between different datasets.
5. Integrity:
o Definition: Consistency in relationships between entities and attributes.
o Assessment: Ensure coherence in data relationships.
6. Timeliness:
o Definition: Availability of data when needed.
o Assessment: Evaluate if data is accessible at the required time.
Scoring System Example:
 Utilize a scaling system (e.g., 1 to 10) for each data quality characteristic.
 Stakeholders rate the data quality based on the defined characteristics.
Example Scoring System:
 Stakeholders assign scores for each characteristic.
 Aggregate scores to calculate an overall quality score.
Risk Probability and Impact Assessment:
Purpose:
 Analysis Method: Evaluates the likelihood (probability) and potential effects (impact) of
identified risks on project objectives.
 Objective: Determine the magnitude and priority of risks for further action and response
planning.
Steps:
1. Assigning Scales:
o Numeric or Nominal: Probability and impact are assigned scales, either numeric
(e.g., 0.1 to 0.3) or nominal (e.g., very low, low, moderate, high).
o Corresponding Values: Qualitative scales require corresponding numeric values to
determine risk ratings.
2. Qualitative Scales and Numeric Values:
o Objective-Dependent: Assign numeric values based on project objectives (cost,
schedule, scope, quality).
o Explanations: Values may come with explanations, varying according to the
specific project objectives.
Example Probability and Impact Scales:
Scale Probability Impact
Numeric 0.1 - 0.3 0.1 - 0.3
Qualitative Very Low - High Very Low - High
Project Objectives and Numeric Values:
Project Objectives Probability Impact
Cost 0.1 - 0.3 0.1 - 0.3
Schedule 0.1 - 0.3 0.1 - 0.3
Scope 0.1 - 0.3 0.1 - 0.3
 Project Objectives Probability Impact
Quality 0.1 - 0.3 0.1 - 0.3
Conclusion:
 Risk probability and impact assessment provides a structured approach to prioritize
risks.
 Project-specific scales ensure relevance to objectives and facilitate meaningful analysis.
 The outcome guides further risk response planning based on risk magnitude and priority.

Project Very Low Low Moderate High Very High

Objective 0.05 0.10 0.20 0.40 0.80
Cost Insignificant Less than 5% 5–10% cost 10–20% cost Greater than
cost increase cost increase increase increase 20% cost
increase
Schedule Insignificant Schedule Overall Overall Overall
schedule slippage less project project project
slippage than 5% slippage 5– slippage 10– schedule slips
10% 20% greater than
20%
Scope Scope Minor areas Major areas Scope Project end
decreases of scope are of scope are reduction item is
barely affected affected unacceptable effectively
noticeable to the client useless
Quality Quality Only very Quality Quality Project end
degradation demanding reduction reduction item is
barely applications requires unacceptable effectively
noticeable are affected client to the client unusable
approval

Probability and Impact Matrix:

Overview:
 Purpose: Determines risk ratings by multiplying probability and impact values.
 Matrix Zones: Identifies low, moderate, and high priority zones for risks.
 Decision Making: Guides risk response decisions based on risk scoring.

Equation for Risk Score:

Risk Score=Probability × Impact Risk Score=Probability × Impact
Matrix Zones:
 Low Priority: Risk scores falling within a predefined low range.
 Moderate Priority: Risk scores falling within a predefined moderate range.
 High Priority: Risk scores falling within a predefined high range.
Use in Decision Making:
 Risk Response Planning: Informs decisions on appropriate risk response strategies based
on risk scores.
 Priority Setting: Helps prioritize risks for detailed analysis and response planning.

Other Risk Matrices:

Overview:
 Purpose: Evaluate risk impact and prioritize risks.
 Visual Representation: Provides a clear visual indication of highest risk areas.
 Numerical Value Attachment: Optionally includes numerical values for precise
assessment.
1. Visual Risk Matrix:
 Representation: Typically displays risk impact and probability graphically.
 Highest Risk Areas: Easily identifiable through visual representation.
 Priority Action: Helps determine which risks require immediate action.
 Watch List: Identifies risks that can be placed on a watch list for monitoring.
2. Numerical Risk Matrix:
 Similarity: Resembles the visual risk matrix but includes numerical values.
 Enhanced Precision: Numerical values provide a more precise assessment of risk impact.
 Prioritization: Helps prioritize risks based on both visual and numerical indicators.
 Actionable Insights: Facilitates decision-making for risk response planning.
Conclusion:
 Both matrices serve the purpose of evaluating and prioritizing risks.
 Visual representation aids in quick comprehension.
 Numerical values add precision to risk impact assessment.
  Combined use provides comprehensive insights for risk management.

Dealing with Risk: Governance Levels

Risk Scores and Corresponding Governance:
 Extreme (18–25):
o Governance Required:
 Senior Project Manager required
 Executive Manager involvement required
 Executive Sponsor and Executive Steering Committee required
 High (12–17):
o Governance Required:
 Project Manager required
 General Manager involvement required
 Executive Sponsor and Senior Management Steering Committee required
  Moderate (6–11):
o Governance Required:
 Project Manager required
 Cross-Departmental Manager involvement required
 GM Sponsor and PMO-based Steering Committee required
 Low (1–5):
o Governance Required:
 Project Manager/Senior Manager required
 Departmental Manager involvement required
 Department Sponsor and PMO-based Steering Committee required
Conclusion:
 Risk Score Significance: Indicates the severity of the risk.
 Governance Hierarchy: Specifies the level of management involvement based on risk
severity.
 Structured Response: Ensures appropriate governance for effective risk management.
 Tailored Approach: Allows for a customized response to risks based on their assessed
scores.

Assessment of Other Risk Parameters:

1. Urgency:
 Definition: The period within which a response must be implemented for
effectiveness.
 Significance: Determines the time sensitivity of risk response.
2. Proximity:
 Definition: The time before a risk might impact project objectives.
 Significance: Short periods indicate high proximity, emphasizing imminent risks.
3. Dormancy:
 Definition: The time after a risk occurs before its impact is discovered.
 Significance: Short dormancy periods indicate quick identification of impact.
4. Manageability:
 Definition: The ease with which the risk owner can manage the occurrence or
impact.
 Significance: High manageability signifies easier risk management.
5. Controllability:
 Definition: The degree to which the risk owner can control the risk outcome.
 Significance: High controllability implies greater control over risk outcomes.
6. Detectability:
 Definition: The ease with which the results of the risk occurrence can be
detected.
 Significance: High detectability facilitates timely recognition of risk occurrences.
 7. Connectivity:
 Definition: The extent to which the risk is related to other project risks.
 Significance: High connectivity indicates interdependence with other risks.
8. Strategic Impact:
 Definition: The potential for the risk to impact the organization’s strategic goals.
 Significance: Assesses the broader implications of risks on strategic objectives.
9. Propinquity:
 Definition: The degree to which a risk is perceived to matter by stakeholders.
 Significance: Reflects stakeholder perception of risk importance.

Top Ten Risk Item Tracking:

 Purpose:
o Identify and maintain awareness of top ten project risk items.
 Components:
o Current ranking, previous ranking, frequency on the list, progress summary.
 Importance:
o Facilitates periodic review and management focus on critical project risks.

Watch List:
 Definition: A list of
low-priority risks
identified as
potential risks.
 Purpose:
Identifying risks for
potential
quantitative
evaluation.
 Importance:
Allows monitoring
of low-priority risks
that may require
further attention.