Qualitative Risk Analysis

Knowledge Major Primary Inputs Tools & Primary Outputs

Areas Processes Techniques

Qualitative Assessing the 1. Organizational 1. Risk 1.Risk Register

Risk Analysis impact and Process Assets probability & (Updates)
likelihood of impact
2. Risk Register
identified risks. assessment
2. Probability and
3. Project Scope impact matrix
Statement

3. Risk data
4. Project
Management Plan quality
assessment

4. Risk
Categorization

5. Risk urgency
assessment
Focuses on prioritizing risks using probability and impact of the risk as well as time frame
and risk tolerance. It also leads to over all risks of the project. It is also known as Risk
assessment.

IP: OP assets, project scope statement, RMP, Risk Register,

TT: Risk probability and impact assessment, Probability and impact matrix, Risk data
quality assessment, Risk Categorization (based on common causes, using
RBS/WBS/Phases), Risk urgency assessment.

OP: risk register (updates)

Probability and Impact Matrix

Based on Failure Modes and Effects Analysis (FMEA)

From 1950s analysis of military systems

Probability and Impact Matrix

Risk Register Update

Quantitative risk analysis outputs are

1. Prioritized risk lists,

2.Probabilistic cost estimates at completion per project phase and probabilistic schedule
estimates for key milestones to help the project manager allocate reserve accordingly,

3.Probabilistic estimates of meeting desired technical performance parameters and validating

technical performance of key components

Estimates of the probability of meeting cost, technical performance, and schedule objectives
(e.g., determining the probability of achieving the planned estimate at completion)
Updated Risk Register
Probabilistic analysis for project success (time and cost)
Updated priority of risk events
Trends in risk analysis

The process of numerically analyzing the effect of identified risks on the projects
objectives In particular, the project schedule and the project costs.

Quantify possible outcomes for the project

Assess probability of achieving specific project objectives

Identify risks requiring most attention

Identify realistic and achievable cost, schedule, or scope targets, given project risks

Determine best management decision when conditions or outcomes are uncertain

Analyze numerically the probability and consequence of each risk

Monte Carlo analysis popular

Decision Tree analysis on test

Diagram that describes a decision and probabilities associated with the

choices

Expected Monetary Value Analysis (EMV)

Expected Monetary Value (EMV)

Decision Tree Analysis

EXAMPLE of Qualitative Analysis - Opportunity

RISK: If the new data center is completed early, then the project can take
advantage of the new technology, which will optimize the software development
process.

Probability Rating The probability of the data center completing early is 35% so
the Probability Rating is Moderate.

Impact Rating:
1x2x2x2=8

The Impact Rating is Low.

Using the following table, the Risk Score and be derived:

The Probability Rating is Moderate so the Probability Value = 2

The Impact Rating is Low so the Impact Value = 2

Risk Score = 2 x 2, or 4

Using the PIM for Opportunities we find this risk resides in the RED area. This
means it is something to be aware of, but as the project manager, you may not
want to put any resources towards it because it doesnt score very high.
ity
Probabil

Impact
Low Moderate High
High 6 12 18
Moderate 4 8 12
Low 2 4 6
EXAMPLE of Qualitative Analysis - Threat

RISK: If the user community does not become properly involved in the
requirements gathering phase of this software development project, there is a
chance we will miss an important feature.

Probability Rating The probability of this group not placing the proper priority of
the requirements phase of the project is 80% so the Probability Rating is High.

Impact Rating:

3 x 3 x 3 x 2 = 54

The Impact Rating is High.

Using the following table, the Risk Score and be derived:

The Probability Rating is High so the Probability Value = 3
The Impact Rating is High so the Impact Value = 6

Because the risk is a Threat, a -1 multiplier is included in the calculation:

Risk Score = -1(3 x 6), or -18

Using the PIM for Opportunities we find this risk resides in the RED area. This
means it is something to keep a very close watch on.
Probability

Impact
Low Moderate High
High -6 -12 -18
Moderate -4 -8 -12
Low -2 -4 -6

Project Log Risks Register

The Risk Register within the Project Log will calculate the Risk Score based on the
inputs to the Probability and Impact fields. The Risk Register will also colorize
the risks based on the PIM parameters presented in this document.

Prioritizing project risks - Risks can be prioritized using any of the fields
contained in the Risk Register. Using the sorting capability native to Microsoft
Excel, users have the ability to sort risks based on the different fields. This
allows the a variety of views of the same data while placing an emphasis on
specific field information that may be the priority, such as Risk Score, Timing or
Risk Triggers.

Quantitative Risk Analysis:

it assigns numerical ranking to the prioritized risks primarily uses Monte Carlo
Simulation and Decision Tree Analysis. It should be redone after RRP and RMC to asses
risk reduction.

IP: OP Assets, Scope Statement, RMP, Risk Register, PMP (SMP, CMP).

TT:

1. Expert Judgment
2. Data Gathering and Representation Techniques

o Interviewing,

o Probability Distribution Beta Distribution and Triangular

Distribution can use ordinal or cardinal values. Both uses 3 point
estimates and are continuous distribution. Decision tree uses
representation of discrete distribution. Uniform distribution can be used
when no obvious value in early concept stage of design.

3. Quantitative Risk Analysis and Modeling Techniques

o Sensitivity Analysis Determine which risks have most potential

impact, Tornado Diagram (compares relative importance of variables
that have a high degree of uncertainty to those more stable)

o Expected Monetary Value Opportunity expressed as Positive,

Risk expressed as negative example Decision tree. Modeling and
Simulation is recommended for Cost & Schedule Risk analysis because
they are more powerful and less subject to misuse than EMV analysis.

o Decision tree analysis Shows available choices and their

possibilities with more complex process than EMV. It assumes mutual
exclusivity.

o Modeling and Simulation Done using Monte Carlo Technique.

In simulation project model is calculated many time (iterated), with the
input values randomized from a probability distribution function and a
probability distribution is made. Cost Risk Analysis use CBS or WBS.
Schedule Risk analysis use PDM.

OP: Risk Register (updates)

Risk Response planning:

It creates owner for each agreed to and funded risk. Risks responses are developed in
risk planning and risk response planning stage
IP: RMP, Risk Register

TT: Strategy for negative risk (avoid, transfer, mitigate), Strategy for positive risk
( exploit, share, enhance), for both acceptance, contingent response strategy,

OP: Risk Register (Updates), PMP (updates), Risk related contractual agreement.