In this article, Amanda describes the tool used in Qualitative Risk Assessment to categorize risks based on its probability and impact on a project. An example helps illustrate this point.
slide 1 of 2
A project is faced with risks at every phase of its life cycle. These risks may be expected or unexpected, and when encountered, needs time and attention. Depending on the type of risk, a risk can be a boost or a hindrance to a project.
In order to understand the many risks that a project faces, a qualitative and quantitative analysis of risks in a project has to be done. While quantitative analysis assigns a numerical value to the risk, qualitative analysis, on the other hand, indicates the probability and the impact of the risk on the project in terms of seriousness and urgency.
A project risk matrix is used when ‘qualitatively’ analyzing risks. It is a process of rating a risk's probability against its impact. It is applied to individual risks and not to a group of risks in a risk sequence or to complete project as such. A sample of a project risk matrix is illustrated below.
slide 2 of 2
Example of a Probability Impact Matrix
A probability-impact matrix is used to highlight the status of risks at a glance. There are many ways of expressing the probability and impact relationship of risks in a project. The most popular way, however, is to rate them as Very High, High, Medium, Low, and so on.
Let us assume in this sample of a project risk matrix, nine individual risks have been identified in a project (refer to the diagram). They are marked against a rating scale of High, Medium and Low for both Probability and Impact.
Risk 1: Low probability and low impact
Risk 2: Medium probability and low impact
Risk 3: High probability and low impact
Risk 4: Low probability and medium impact
Risk 5: Medium probability and medium impact
Risk 6: High probability and medium impact
Risk 7: Low probability and high impact
Risk 8: Medium probability and high impact
Risk 9: High probability and high impact
Risks with a low probability and low impact do not pose much of a threat to a project. They may be easily handled by the project manager/project team and might require supervision or superficial monitoring. As the impact of the risk on a project increases, more time, attention and detailed risk management might be required, by not only the project team, but also all stakeholders involved. An identified risk with a high probability and impact may require additional funds, time and resources to overcome it. It is indicative of urgent attention required.
When a probability-rating score has been assigned to a risk as in 1-6 in the diagram, it becomes easy for all the stakeholders involved to assess the damage a risk might pose to a project, which becomes part of the risk assessment report. The higher the P-I Score, the more aggressive the risk management approach should be.
Risk Management is an area of expertise that every project manager should be trained in. It takes a project manager through the process of first identifying and assessing risks in a project. When identifying and assessing risks, many tools and techniques have to be used.