Qualitative risk assessment

The risk analysis stage seeks to understand the level of exposure from risk by exploring the likelihood of the occurrence of the risks and the consequences and magnitude of the potential impact. This can be done qualitatively or quantitatively.

Qualitative analysis

The purpose of qualitative analysis is to order the risks by their importance, without quantifying (costing) them. This should be carried out during the first phases of the risk management process.

An assessment is made (either by an individual or a group) of the likelihood that the risk will occur and the magnitude of its potential impact. The qualitative severity rating is arrived at by a number of methods. The simplest is to multiply the likelihood of occurrence score by the impact score, noting that the impact may be cost but is not necessarily so. Impact can be time, schedule related or any other impact category such as security, quality, reputation, etc.

Alternatively the assessment can be weighted where great influence is given to specific areas of the table.  For instance it may be that the project wishes to prioritise low likelihood, high impact risks and can weight the assessment appropriately.

Likelihoods and impacts are typically assessed using scales similar to the one below based on a 5-point scale.  The scales can vary, however, and for large projects or programmes several scales can be used for different areas or functions. Most risk databases allow for multiple scales to be used:

• very high (VH);
• high (H);
• medium (M);
• low (L); and
• very low (VL).

The tables below are an example of possible scales which could be used for likelihood and impact assessment.

Likelihood

Description	Scenario	Guide probability
Very high	almost certain to occur	75-99
High	more likely to occur than not	50-75
Medium	fairly likely to happen	25-50
Low	low but not impossible	5-25
Very low	extremely unlikely to happen	>5

Impact

Description	Scenario	Guide cost % of project	Guide time % of prog
Very high	Critical impact on the achievement of objectives and overall performance. Huge impact on costs and/or reputation. Very difficult and possibly long-term to recover.	2.00%	5.00%
High	Major impact on costs, objectives. Serious impact on output and/or quality and reputation. Medium to long-term effect and expensive to recover.	1.50%	3.00%
Medium	Reduces viability significant waste of time and resources and impact on operational efficiency, output, and quality. Medium term effect, which may be expensive to recover.	1.00%	1.50%
Low	Minor loss, delay, inconvenience or interruption. Short to medium term effect.	0.50%	0.75%
Very low	Minimal loss, delay, inconvenience or interruption. Can be easily and quickly remedied.	0.25%	0.25%

In qualitative analysis values are typically allocated to likelihood and impact to assist in ordering and prioritising risks.

For example, high likelihood (rating 3) x high impact (rating 3) = total risk rating of 9.

As already discussed, it is possible to use a weighted scoring system to rate impacts higher than likelihoods.

Once the risks have been analysed, the results can be displayed in table format by marking individual risks on the matrix to give an overall pictorial view of the main risks affecting the project, see Figure 4. This is a good method of showing where the risks initially sit and provides a measure for how to show improvement in risk following mitigation as risk move away from the top right to the bottom left. .

Currently, the assessment of risk is against a single impact. The single impact is a combination of all relevant impacts such as time, cost, fitness for purpose and reputation. If required, each risk can be assessed against multiple impacts to show the effect particular risks have on their project objectives and at program level the overall delivery objectives.

An example of a standard heat diagram (with ratings).

Figure 4: A standard heat diagram.

An example of a heat diagram with risk ratings skewed towards impact.

Figure 5: A heat diagram with risk ratings skewed towards impact.

It is nearly always the case that there are more risks than can be reasonably managed so some form of selection for management focus is required.  The most important is probably proximity, i.e. the point in the future at which the risk will occur. The allows most attention to be focused on risks with high likelihoods and impacts which will occur imminently.