PROJECT RISK

MANAGEMENT
Chapter 3
Performing Qualitative Risk
Analysis
Chapter 3
Performing Qualitative Risk Analysis

• Qualitative risk assessment is the most • Preparing these can help you avoid
useful part of the risk management potentially costly delays or mistakes,
process and it lays the foundation for which helps ensure the project
all the subsequent stages in that succeeds.
process, including the quantitative
analyses that are frequently required • Qualitative risk analysis is a formal
to define budgets and time-scales. process for evaluating the likelihood
and potential impact of project risks.
• Qualitative risk analysis is an essential
step when conducting risk • It provides a framework for ranking
management that helps you manage a risks according to the level of threat
project and maintain its schedule. they pose to inform project risk
management strategies.
Qualitative Methodologies

• Qualitative methodologies concern • Placing decisions in the context of

themselves with how management alternative future environments
decisions are actually made, rather permits the opening up of
than the traditional operational discussions about threats and
research approach of obtaining the opportunities.
“right” answer.
• Simplicity and clarity are sought,
and uncertainty treated as a fact.
• Methodologies that can screen out
unfeasible alternatives, study the • Outside influences such as
entire range of solutions, and technical, commercial and political
explore the effect of likely considerations are identified and
constraints, will develop considered in direct relation to
contrasting possibilities as to what internal issues.
is required.
• Qualitative risk analysis is • The outcome of this process
the process of identifying, is a list of risks with their
analyzing and evaluating corresponding probabilities
risks in an organization. and impacts.
• relatively straight-forward
• Qualitative risk analysis uses technique that can be
subjective expert judgment applied to many types of
to determine the probability projects.
of a risk occurring and its
impact on an organization.
 • Prioritize risks according to
probability & impact
Qualitativ
• Identify the main areas of
e analysis
of risk risk exposure
serves 3 • Improve understanding of
functions: project risks
 • Performing a qualitative risk
analysis isn’t particularly
difficult, but it takes focus and
attention to detail.
5 Step process
to perform a
qualitative risk
analysis • It requires a project manager or
risk manager to follow this
process carefully.
1. Put together a team 2. Isolate all potential risks.
to identify risks.
• What may seem like a minor
risk can quickly expand to
become a significant
It’s crucial to assemble a concern.
team of subject matter
experts that bring direct • Avoid assuming that some
knowledge and experience threats don’t need to be
to help project managers considered. It’s better to
isolate potential trouble document all risks, then
spots. analyze and assign a
weighting that can be re-
3. Rate and prioritize each risk /impact
assessment :
• Based on its impact and likelihood of
occurring, each risk should be rated to
determine if it’s a high priority or low • 5. Monitor each risk and re-
concern. evaluate: It’s not enough to
identify risks and come up with
solutions. Often, as a project is
4. Develop strategies to address risks progressing, risks, their impact,
based on their priority / Risk and the likelihood of occurring can
Treatment :
change. Revisit risks as each crops
• After setting the priority for each risk,
work with subject matter experts to
up and is addressed.
come up with potential strategies to
address them. Make sure to think about
the impact of each solution on other
risks and solutions.
1. Identifying Risks / Put together a
team to identify potential risks

• Risk identification is arguably the • Risk identification is all about

most important part of qualitative risk
analysis. If you fail to identify risks
quantity. So, reach out to as
ahead of time, it becomes extremely many people as you can to
challenging to manage them. get a wide range of views.

• The trick to risk identification is

keeping it simple. Start thinking of
anything which could have an
uncertain effect on your project.
Capturing the obvious risks will help
lead you deeper into more slanted
ones.
Tools for Risk Identification
2- Impact Analysis

• Mind maps/Brainstorming • Once you’ve identified possible risks, the next

• Questionnaires step is to consider their potential impact.
• Interviews • Segregate the risks into threats and
• Documentation review opportunities, but remember that they
• Checklist analysis are similar but not opposite.
• SWOT Analysis • Using qualitative risk analysis, estimate the
impact of each risk on a scale (1-5 or
low/medium/high/extreme).
• Next, estimate the probability of each risk
occurring, using a similar scale.
• Finally, take those scores and combine them
to create a total risk ranking.
• Simplicity is the major benefit of qualitative
risk analysis;
 3. Risk Treatment 4. Review & Monitor

• The next stage in the qualitative risk analysis • Risk management is never over, not even
is to apply treatments to each risk. This can after the project has finished. As the project
be approached in any number of ways progresses, it’s important to keep risk logs
up to date.
depending on your industry or process.

• At each stage of the project, risk probability

• A simple example could show five options
will fluctuate. Some risks will disappear,
when it comes to risk treatment, but these while others might increase in likelihood.
are by no means definitive: Reviewing your risks regularly will help
• Accept keep you on top of these changes.
• Mitigate
• After the project, a full retrospective will
• Exploit
provide valuable data and experience for
• Transfer future projects, making the next one more
• Avoid secure and helping to further your risk
maturity.
Qualitative tools and techniques

• Expert judgment, data gathering, • Data analysis involves risk

and data analysis are just some of probability (likelihood) and
the qualitative risk analysis tools
impact.
teams can use. Each has its
benefits and drawbacks.
• Expert judgment provides insight • Performing a thorough
based on similar experiences and qualitative risk analysis to
is somewhat subjective, while data
isolate and prioritize risks,
gathering provides information
from stakeholder interviews.
develop strategies to
address, monitor, and re-
There are four inputs to Qualitative risk
analysis:
Risk register. Risk management plan.

This of course, is the source of it will clarify the overall approach

all of the known risks that are that needs to be taken to risk
management on this particular
to be analyzed. project as well as stating how much
risk is acceptable and who should be
involved in carrying out
the qualitative risk analysis of the
project risks.
 Project scope statement. Organizational process assets.

• This key document describes both the • These will include aspects such
project and product deliverables along as tools to help carry out
with the objectives of the project and qualitative risk analysis, policies,
to the requirements, along with the procedures and guidelines for
constraints and assumptions. risk management, and historical
information including lessons
• When it was first created within the learned from previous similar
define scope process, it also included projects.
all the identified risks known at that
time, and these will be used along
with the other information within this
document for qualitative risk analysis.
 Types of qualitative risk
Risk register updates.
Analysis
This is the only output from • The five most common
this process. Prior to qualitative types of analysis are:
risk analysis, the risk register
contains a list of all of the risks, 1. Probability/
but now extra information can be Consequence Matrix
added to the risk register 2. Bow-Tie Analysis
including the priority of urgency of 3. Delphi Technique
each risk, their categorization and
any trends of have been observed 4. SWIFT Analysis
while carrying out this process. (Structured What-IF
Technique)
5. Pareto Principle
 1. Probability/Consequence
1. Probability/Consequence Matrix
Matrix
• To many, this is the standard method of • By ranking risk probability
establishing risk severity. Risk matrices will
often vary in size, but they all essentially do the against risk consequence, you
same thing. They provide a practical way to can see the main driver of risk
rank the overall severity of a risk by multiplying
the likelihood of risk occurrence against the
severity, whether that’s a
impact of the risk, should it still occur. probability or a consequence.
• A probability and impact matrix is a tool used in
qualitative risk analysis to evaluate the • This information helps identify
likelihood and impact of identified risks. It uses suitable treatments to
a numerical scale to rate the likelihood and
impact of each risk, which can then be used to manage the risk, based on its
prioritize risks and develop strategies to prominent drivers.
mitigate or manage them.
The qualitative risk
matrix in below
figure shows high-
priority risks in red
and the lowest in
green.
A score of 1 to 5 was given to each risk for both
probability and impact. The following key was used
for scoring.
Impact Probability

1. Very low impact – not significant to 1. Very low probability – not worth
project considering
2. Low impact – can be managed 2. Low probability – unlikely to
without mitigation occur
3. Medium impact – may require 3. Medium probability – realistic
mitigation chance of occurrence
4. High impact – significant impact on 4. High probability – likely to occur
cost / schedule 5. Very high probability – almost
5. Very high impact – can be a “project certain to occur
killer”
 2. Bow-tie Analysis
• A bow-tie analysis is one of the • A 'bowtie' is a diagram that
most practical techniques for visualizes the risk you are
identifying risk mitigations.
dealing with in just one, easy
to understand picture.
• Bow-tie analysis starts by looking
at a risk event and then projects it
in two directions. On the left, you • A simple diagram is required
list all the potential causes of an to communicate the range of
event. causes and consequences
• On the right, you list all the
and the associated controls
potential consequences of the
event.
 Advantages Disadvantages

• The Bow-Tie Diagram is simple to read and • Does not provide quantitative assessment or
understand - it gives a clear understanding of the evaluation of the acceptability of risks unless
threat controls and consequences that apply to a linked to fault tree analysis or event tree
system
analysis
• The technique is not overly complex and the
• In depth knowledge required/essential – high
approach can be understood by non-specialists
level of knowledge regarding a system and
• On the left hand side of the diagram the full range of
the components of the system that relate to
initiating events and intervening safeguards and the safety
way they combine and escalate are clearly shown
• On the right hand side of the diagram the many • No standards exist therefore there is a range
possible consequences and outcomes are defined of different and subtle representations of
and the barriers are shown in an equivalent manner bow-tie diagrams
• The linkage of the barriers to the safety
management system can be made explicit • The technique does not provide a framework
to evaluate whether the selected safeguards
are sufficient
 3. Delphi Technique

• The process of consulting

field experts to predict how
risky a certain action would
be. Between a panel of
experts and several rounds
of feedback and response
modification, a conclusion is
reached by the panel.
 Steps to be followed :

Strengths :
• It involves input from technical experts and seeks to
1. Identify experts and ensure reach the "correct" response through consensus.
their participation • It can be done virtually. Absence of face-to-face

2. Choose a facilitator meetings eliminates biased viewpoints and preventing

any undue influence of one expert over another.
3. Define the problem • Anonymity allows the experts to express their opinions

4. Send request and have the freely, encourages openness and avoids admitting
errors by revising earlier forecasts.
experts evaluate Weaknesses:
independently • Limited to technical risks.

5. Gather expert • The process may be time consuming and is dependent

opinions .Review and restate on the actual expertise of the experts. You may need to
wait long periods of time for experts to respond.
the responses • It also greatly reduces immediate access to the
6. Repeat the process knowledge of others.
 Critical success factors (CSFs) for 4. SWIFT Analysis
effective application :

• Effective facilitation is • It's a risk analysis method that focuses on

identifying potential risks associated with
required. changes made to a project plan. As its name
• Careful selection of experts is suggests, team members have to come up
with any “what if” questions they can to find
needed. out all the potential risks that could arise.
• Clear definition of scope
• The Structured What-If Technique (SWIFT)
combines the use of checklists with a
brainstorming ‘What if?’ approach.

• The Structured What-If Checklist is a

thorough, systematic, multi-disciplinary team
orientated analytical technique.
 4. SWIFT Analysis
4. SWIFT Analysis

• The Structured What-If • SWIFT is generally applicable

Technique is a for almost every type of risk
"brainstorming" method assessment application,
where "What-If" questions especially those dominated
are generated using a variety by relatively simple failure
of sources such as checklists, scenarios.
past incidents, standards and
guidelines etc. • It can be used alone, but
most often used to
supplement other, more
structured techniques.
• What–If Analysis is a
structured brainstorming
method of determining what
things can go wrong and
judging the likelihood and
consequences of those
situations occurring.
 Advantages Disadvantages

• Adequate preparation of a checklist in advance is

• The technique is efficient because it
critical to achieve completeness.
generally avoids lengthy discussions of areas • Its benefit depends on the experience of the leader
where hazards are well understood or where and the knowledge of the team.
prior analysis has shown no hazards are
known to exist. • SWIFT relies exclusively on the knowledge of the
• It is very flexible, and applicable to any type participants to identify potential problems. If the
of installation, operation or process, at any team fails to ask important questions, the analysis is
stage of the lifecycle. likely to overlook potentially important weaknesses.
• It is quick, because it avoids repetitive
consideration of deviations. • Reviewing a what-if analysis to detect oversights is
• It uses the experience of operating personnel difficult because there is no formal structure against
as part of the team. which to audit.
• If the subject matter experts are not
• Most what-if reviews produce only qualitative
available for the SWIFT session their
questions can be gathered in advance and results; they give no quantitative estimates of risk-
related characteristics. This simplistic approach
included in the checklist.
offers great value for minimal investment, but it can
• The checklists used are robust as the answer more complicated risk-related questions only
questions asked intuitively cover historical if some degree of quantification is added (for
incidents that have happened in the past example using Risk Matrices).
 5. Pareto Principle
• The Pareto Principle states that 80 percent of
a project's benefit comes from 20 percent of
• The key steps to conduct
the work. Or, conversely, that 80 percent of
problems can be traced back to 20 percent
a Pareto Analysis are:
of causes. Pareto Analysis identifies the
problem areas or tasks that will have the
biggest payoff. 1. Identify the problems
• Better known as the "80/20 Rule", the Pareto 2. Identify root causes
Principle helps in identifying risks that will be
most effective.
3. Score the problems
4. Group problems
• Risk managers use Pareto analysis as a tool
for rapidly identifying the most critical 20%
5. Tally the scores
of risks that will effectively mitigate 80% of 6. Action
the impact.
 Disadvantages Of Pareto
Advantages Of Pareto Analysis
Analysis

1. Easy and Effective 1. Based on Past Data

2. Problem Analysis 2. Only Identifies
3. Decision-Making Traits Problems
3. Qualitative in Nature
4. Inaccuracy in Scoring-
Limitations of Qualitative Risk
Analysis
1. Subjective Evaluation 2. Limited Scope

• A qualitative risk analysis produces no • The qualitative risk analysis

metrics, it depends on the perception of
a person carrying out the study.
assesses each risk on a
project but doesn't provide
• In order to minimize subjectivity, a an assessment of the overall
qualitative risk analysis should involve project risk exposure.
several people.

• The accuracy and detail of the analysis • The analysis also won't
depends on previous team experience. If calculate how much risk
the risk team hasn’t experienced a
management activities and
project type, they might miss some risks
or assess them inadequately. risk treatment will cost.
Limitations…
3. Lack of Differentiation
What are the benefits of
qualitative risk analysis?
• Once several risks fall into the • Provides a structured
same category, for example,
high likelihood and medium approach to risk
impact, there is no further way management:
to differentiate between the • Qualitative risk assessment
severity of risks and no way to breaks down the risk
determine which risk should be management process into a
dealt with first. series of well-defined steps.

• This helps ensure all potential

risks are identified and addressed
in a systematic manner.
benefits of qualitative risk analysis…

Develops an effective risk Facilitates effective decision-

management plan: making:

• Qualitative risk assessment

• Qualitative risk analysis offers a clear understanding
identifies all potential project of potential risks and their
risks as well as their impact on your project.
corresponding mitigation
measures. This helps your • This allows you to make
project stay on track and informed decisions about
within budget. how to best mitigate or
avoid the risks
 Improves the overall project
communication:

• Qualitative risk analysis provides

a common framework and
language for discussing risks.

• This ensures all project

stakeholders are on the same
page in terms of understanding
potential risks and their impact
on the project.