11.3.1 Inputs to Qualitative Risk Analysis

.1 Risk management plan. This plan is described in 11.1.3.

.2 Identified risks. Risks discovered during the risk identification process are evaluated along with their potential impacts on the project.

.3 Project status. The uncertainty of a risk often depends on the project´s progress through its life cycle. Early in the project, many risks have not surfaced, the design for the project in immature, and changes can occur, making it likely that more risks will be discovered.

.4 Project type. Projects of a common or recurrent type tend to have better understood probability of occurrence of risk events and their consequences. Projects using state-of-the-art or first-of-its-kind technology—or highly complex projects—tend to have more uncertainty.

.5 Data precision. Precision describes the extent to which a risk is known and understood. It measures the extend of data available, as well as the reliability of data. The source of the data that was used to identify the risk must be evaluated.

.6 Scales of probability and impact. These scales, as described in Section 11.3.2.2, are to be used in assessing the two key dimensions of risk, described in Section 11.3.2.1.

.7 Assumptions. Assumptions identified during the risk identification process are evaluated as potential risks (see Section 4.1.1.5 and Section 11.2.2.4).

11.3.2 Tools and Techniques for Qualitative Risk Analysis

.1 Risk probability and impact. Risk probability and risk consequences may be described in quslitative terms such as very high, moderate, low, and very low.
  Risk probability is the likelihood that a risk will occur.
  Risk consequencesis the effect on project objetives if the risk event occurs.
  These two dimensions of risk are applied to specific risk events, not to the overall project. Analysis of risks using probability and consequences helps identify those risks that should be managed aggressively.

.2 Probability/impact risk rating matrix.. A matrix may be constructed that assigns risk ratings (very low, low, moderate, high, and very high) to risk or conditions based on combining probability and impact scales. Risks with high probability and high impact are likely to require futher analysis, including quantification, and aggressive risk management. The risk rating is accomplished using a matrix and risk scales for each risk.
  A risk´s probability scale naturally falls between 0.0 (no probability) and 1.0 (certainty). Assessing risk probability may be difficult because expert judgment is used, often without benefit of historical data. An ordinal scale, representing relative probability values from very unlikely to almost certain, could be used. Alternatively, specific probabilities could be assigned by using a general scale (e.g., .1/.3/.5/.7/.9).
  The risk´s impact scale reflects the severity of its effect on the project objective. Impact can be ordinal or cardinal, depending upon the culture of the organization conducting the analysis. Ordinal scales are simply rank-ordered values, such as very low, low, moderate, high, and very high. Cardinal scales assign values to these impacts. These values are usually linear (e.g., .1/.3/.5/.7/.9), but are often nonlinear (e.g., .05/.1/.2/.4/.8), reflecting the organization´s desire to avoid high-impact risks. The intent of both approaches is to assign a relative value to the impact on project objectives if the risk in question occurs. Well-defined scales, whether ordinal or cardinal, can be developed using definitions agreed upon by the organization. These definitions improve the quality of the data and make the process more repeatable.
   Figure 11–2 is an example of evaluating risk impacts by project objective. It illustrates its use for either ordinal or cardinal approach. These scaled descriptors of relative impact should be prepared by the organization before the project begins.
   Figure 11–3 is a Probability-Impact (P-I) matrix. It illustrates the simple multiplication of the scale values assigned to estimates of probability and impact, a common way to combine these two dimensions, to to determine whether a risk is considered low, moderate, or high. This figure presents a non-linear scale as an example of aversion to high-impact risks, but linear scales are often used. Alternatively, the P-I matrix can be developed using ordinal scales. The organization must determine which combinations of probability and impact result in a risk`s being classified as high risk (red condition), moderate risk (yellow condition), and low risk (green condition) for either approach. The risk score helps put the risk into a category that will guide risk response actions.

.3 Project assumptions testing. Identified assumptions must be tested against two criteria: assumption stability and the consequences on the project if the assumption is false. Alternative assumptions that may be true should be identified and their consequences on the project objectives tested in the qualitative risk-analysis process.

.4 Data precision ranking. Qualitative risk analysis requires accurate and unbiased data if it is to be helpful to project management. Data precision ranking is a technique to evaluate the degree to which the data about risks is useful for risk management. It involves examining:

   Extent of understanding of the risk.
   Data available about the risk.
   Quality of the data.
   Reliability and integrity oh the data.

  The use of data of low precision—for instance, if a risk is not well understood—may lead to a qualitative risk analysis of little use to the project manager. If a ranking of data precision is unacceptable, it may be possible to gather better data.

11.3.3 Outputs from Qualitative Risk Analysis

.1 Overall risk ranking for the project. Risk ranking may indicate the overall risk position of a project relative to other projects by comparing the risk scores. It can be used to assign personnel or other resources to projects with different risk rankings, to make a benefit-cost analysis decisison about the project, or to support a recommendation for project initiation, continuation, or cancellation.

.2 List of prioritized risks. Risks and conditions can be prioritized by a number of criteria. These include rank (high, moderate, and low) or WBS level. Risks may also be grouped by those that require an immediate response and those that can be handled at a later date. Risks that affect, functionality, and quality may be assessed separately with different ratings. Significant risks should have a description of the basis for the assessed probability and impact.

.3 List of risks for additional analysis and management. Risks classified as high or moderate would be prime candidates for more analysis, including quantitative risk analysis, and for risk management action.

.4 Trends in qualitative risk analysis results. As the analysis is repeated, a trend of results may become apparent, and can make risk response or further analysis more or less urgent and important.