Two Techniques for Qualitative Risk Analysis

After you identify project risks, you need to analyze them to see which ones are important enough to manage. The most common form of analysis is called qualitative risk analysis. This is referred to as “qualitative” since it is a quick approximation of the risk severity and does not reflect the rigor of a detailed, numerical analysis. The overall risk level can be as simple high, medium, or low (or even high/low), depending on the severity of impact and the probability of the event occurring.

There are many techniques for performing qualitative risk analysis using simple tables. Here are two examples that are fairly common.

High, Medium, Low Table

For example, you can use a table like the one below as a starting point. It helps identify high, medium and low level risks by looking at the probability of the occurrence and the overall impact to your project. For instance, a highly likely / high impact event is obviously a high risk. Likewise an event that has a low impact to your project, and has a low likelihood of occurrence anyway, is obviously a low risk. The other combinations fall somewhere within these two extremes.

Severity of Risk Impact / Probability of Risk Occurring	Overall Risk
High negative impact to project / Highly likely to occur	High
High negative impact to project / Medium likely to occur	High
High negative impact to project / Not likely to occur	Medium/Low
Medium negative impact to project / Highly likely to occur	Medium
Medium negative impact to project / Medium likely to occur	Medium/Low
Medium negative impact to project / Not likely to occur	Low
Low negative impact to project / Highly likely to occur	Low
Low negative impact to project / Medium likely to occur	Low
Low negative impact to project / Not likely to occur	Low

Ignore, Caution, Respond Chart

A second technique uses a simple table that provides guidance on whether you should respond to a risk.

Probability -> Impact	Low	Medium	High
Low	Ignore	Ignore	Caution
Medium	Ignore	Respond	Response
High	Caution	Response	Response

The green boxes represent a combination of probability and impact that you may safely be able to ignore. The red boxes represent combinations that need to be managed. The yellow box represent risks that should be evaluated individually to determine if you should respond or not.

Summary

These are examples of techniques used to analyze project risks. There are many other techniques as well. The point is that qualitative risk analysis relies on subjectivity to determine whether a risk is worth managing or not. For the vast majority of projects this subjective decision is good enough.