THE PROJECT MANAGEMENT KNOWLEDGE AREAS
12. Project Procurement Management
11.3 QUALITATIVE RISK ANALYSIS
Qualitative risk analysis is the process of assessing the impact and likelihood of identified risks. This process prioritizes risks according to their potential effect on project objectives. Qualitative risk analysis is one way to determine the impor- tance of addressing specific risks and guiding risk responses. The time-criticality of risk-related actions may magnify the importance of a risk. An evaluation of the
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
Trends in the results when qualitative analysis is repeated can indicate the need for more or less risk-management action. Use of these tools helps correct biases that are often present in a project plan. Qualitative risk analysis should be revis- ited during the project’s life cycle to stay current with changes in the project risks.
This process can lead to further analysis in quantitative risk analysis (11.4) or directly to risk response planning (11.5).
11.3.1 Inputs to Qualitative Risk Analysis
.1 Risk management plan. This plan is described in 11.1.3.
.2 Identified risks. Risks discovered during the risk identification process are eval- uated along with their potential impacts on the project.
.3 Project status. The uncertainty of a risk often depends on the project’s progress through its life cycle. Early in the project, many risks have not surfaced, the design for the project is immature, and changes can occur, making it likely that more risks will be discovered.
.4 Project type. Projects of a common or recurrent type tend to have better under- stood probability of occurrence of risk events and their consequences. Projects using state-of-the-art or first-of-its-kind technology—or highly complex projects—
tend to have more uncertainty.
.5 Data precision. Precision describes the extent to which a risk is known and under- stood. It measures the extent of data available, as well as the reliability of data. The source of the data that was used to identify the risk must be evaluated.
.6 Scales of probability and impact. These scales, as described in Section 11.3.2.2, are to be used in assessing the two key dimensions of risk, described in Section 11.3.2.1.
.7 Assumptions. Assumptions identified during the risk identification process are evaluated as potential risks (see Sections 4.1.1.5 and 11.2.2.4).
11.3.2 Tools and Techniques for Qualitative Risk Analysis
.1 Risk probability and impact. Risk probability and risk consequences may be described in qualitative terms such as very high, high, moderate, low, and very low.
Risk probabilityis the likelihood that a risk will occur.
Risk consequencesis the effect on project objectives if the risk event occurs.
These two dimensions of risk are applied to specific risk events, not to the overall project. Analysis of risks using probability and consequences helps iden- tify those risks that should be managed aggressively.
.1.2 .3.4 .5.6
.7
Risk management plan Identified risks Project status Project type Data precision Scales of probability and impact
Assumptions
.1 .2 .3 .4
Risk probability and impact
Probability/impact risk rating matrix Project assumptions testing
Data precision ranking
.1 .2.3
.4
Overall risk ranking for the project
List of prioritized risks List of risks for additional analysis and management Trends in qualitative risk analysis results
Inputs Tools & Techniques Outputs
11.3.1|11.3.2.4
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
.2 Probability/impact risk rating matrix. A matrix may be constructed that assigns risk ratings (very low, low, moderate, high, and very high) to risks or conditions based on combining probability and impact scales. Risks with high probability and high impact are likely to require further analysis, including quantification, and aggres- sive risk management. The risk rating is accomplished using a matrix and risk scales for each risk.
A risk’s probability scalenaturally falls between 0.0 (no probability) and 1.0 (certainty). Assessing risk probability may be difficult because expert judgment is used, often without benefit of historical data. An ordinal scale, representing rel- ative probability values from very unlikely to almost certain, could be used. Alter- natively, specific probabilities could be assigned by using a general scale (e.g., .1 / .3 / .5 / .7 / .9).
The risk’s impact scalereflects the severity of its effect on the project objective.
Impact can be ordinal or cardinal, depending upon the culture of the organization conducting the analysis. Ordinal scales are simply rank-ordered values, such as very low, low, moderate, high, and very high. Cardinal scales assign values to these impacts. These values are usually linear (e.g., .1 / .3 / .5 / .7 / .9), but are often nonlinear (e.g., .05 / .1 / .2 / .4 / .8), reflecting the organization’s desire to avoid high-impact risks. The intent of both approaches is to assign a relative value to the impact on project objectives if the risk in question occurs. Well-defined scales, whether ordinal or cardinal, can be developed using definitions agreed upon by the organization. These definitions improve the quality of the data and make the process more repeatable.
Figure 11-2is an example of evaluating risk impacts by project objective. It illustrates its use for either ordinal or cardinal approach. These scaled descriptors of relative impact should be prepared by the organization before the project begins.
Figure 11-3is a Probability-Impact (P-I) matrix. It illustrates the simple mul- tiplication of the scale values assigned to estimates of probability and impact, a common way to combine these two dimensions, to determine whether a risk is considered low, moderate, or high. This figure presents a non-linear scale as an example of aversion to high-impact risks, but linear scales are often used. Alter- natively, the P-I matrix can be developed using ordinal scales. The organization must determine which combinations of probability and impact result in a risk’s being classified as high risk (red condition), moderate risk (yellow condition), and low risk (green condition) for either approach. The risk score helps put the risk into a category that will guide risk response actions.
.3 Project assumptions testing. Identified assumptions must be tested against two criteria: assumption stability and the consequences on the project if the assump- tion is false. Alternative assumptions that may be true should be identified and their consequences on the project objectives tested in the qualitative risk-analysis process.
.4 Data precision ranking. Qualitative risk analysis requires accurate and unbiased data if it is to be helpful to project management. Data precision ranking is a tech- nique to evaluate the degree to which the data about risks is useful for risk man- agement. It involves examining:
■ Extent of understanding of the risk.
■ Data available about the risk.
■ Quality of the data.
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
The use of data of low precision—for instance, if a risk is not well understood—
may lead to a qualitative risk analysis of little use to the project manager. If a ranking of data precision is unacceptable, it may be possible to gather better data.
11.3.3 Outputs from Qualitative Risk Analysis
.1 Overall risk ranking for the project. Risk ranking may indicate the overall risk posi- tion of a project relative to other projects by comparing the risk scores. It can be used to assign personnel or other resources to projects with different risk rankings, to make a benefit-cost analysis decision about the project, or to support a recom- mendation for project initiation, continuation, or cancellation.
.2 List of prioritized risks. Risks and conditions can be prioritized by a number of cri- teria. These include rank (high, moderate, and low) or WBS level. Risks may also be grouped by those that require an immediate response and those that can be handled at a later date. Risks that affect cost, schedule, functionality, and quality may be assessed separately with different ratings. Significant risks should have a description of the basis for the assessed probability and impact.
.3 List of risks for additional analysis and management. Risks classified as high or moderate would be prime candidates for more analysis, including quantitative risk analysis, and for risk management action.
Figure 11–2|11.4
Figure 11–2. Rating Impacts for a Risk
Evaluating Impact of a Risk on Major Project Objectives (ordinal scale or cardinal, non-linear scale)
Project Objective
Very Low .05
Low .1
Moderate .2
High .4
Very High .8
Cost
Schedule
Scope
Quality
Insignificant Cost Increase Insignificant Schedule Slippage
Scope Decrease Barely
Noticeable
Quality Degradation Barely Noticeable
<5% Cost Increase Schedule Slippage
<5%
Minor Areas of Scope Are Affected
Only Very Demanding Applications Are Affected
5–10% Cost Increase Overall Project Slippage 5–10%
Major Areas of Are Affected
Quality Reduction Requires Client Approval Scope
10–20% Cost Increase Overall Project Slippage 10–20%
Reduction Unacceptable to the Client Quality Reduction Unacceptable to the Client Scope
>20% Cost Increase Overall Project Schedule Slips >20%
Project End Item Is Effectively Useless Project End Item Is Effectively Unusable The impacts on project objectives can be assessed on a scale from Very Low to Very High or on a numerical scale.
The numerical (cardinal) scale shown here is non-linear, indicating that the organization wishes specifically to avoid risks with high and very-high impact.
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
A Guide to the
Project
Management Body of
Knowledge
SAMPLE
.4 Trends in qualitative risk analysis results. As the analysis is repeated, a trend of results may become apparent, and can make risk response or further analysis more or less urgent and important.