Risk management; qualitative, quantitative; steps

Project risk management

Project risk management is the systematic process of planning, identifying, analysing, responding to, and monitoring and controlling risks in a project, so that the chance and effect of negative events are reduced and the chance of positive events is increased.

Qualitative and quantitative risk analysis

Qualitative analysis ranks risks by their probability and impact using descriptive scales (very low to very high). It is fast, cheap and used first. Tools: probability-impact matrix, risk categorisation, risk urgency assessment, expert judgement, risk data quality assessment.

Quantitative analysis gives numerical values of the effect of risk on the project objectives. It is applied to the high-priority risks. Tools: expected monetary value (EMV = probability x impact), decision tree analysis, sensitivity analysis (tornado diagram), simulation (Monte Carlo) and PERT three-point estimation.

 Impact ->   Low      Medium     High
 Prob.
 High       Medium     High      High
 Medium      Low      Medium     High
 Low         Low       Low      Medium

Major steps in managing risks

1. Risk management planning: decide the approach, team, roles, budget, tools, risk categories, probability-impact scales and reporting. The output is the risk management plan.
2. Risk identification: find the risks which may affect the project and document them in a risk register (brainstorming, checklist, Delphi, SWOT, interviews, experience).
3. Qualitative risk analysis: rank the risks by probability and impact using a probability-impact matrix to find priority risks.
4. Quantitative risk analysis: estimate the numerical effect of the main risks on cost and time (expected monetary value, decision tree, sensitivity analysis, Monte Carlo simulation).
5. Risk response planning: select the strategy for each risk (avoid, transfer, mitigate/reduce, accept) and prepare contingency plans and reserves.
6. Risk monitoring and control: track identified risks, watch for new risks, check the response is working, update the risk register and report.