M4.2 — Qualitative Risk Analysis

M4.2 — Qualitative Risk Analysis

1. Practical outcome

The learner should be able to take identified risks and assess them systematically so that management attention focuses on what matters. They should be able to assess probability and impact, apply a scoring framework, use a matrix appropriately, consider other relevant factors, prioritise risks, challenge unsupported scoring, recognise bias and false precision, distinguish inherent and residual exposure where relevant, and translate the analysis into action.

The objective is not to create colourful matrices. It is to answer: “Which uncertainties require our attention, and why?”

2. Core concepts

Risk concerns how uncertainty can affect objectives, including uncertain events, conditions, variability and incomplete knowledge. Qualitative risk analysis assesses relative significance so that risks can be prioritised for attention and response.

Common dimensions are probability and impact. Impact may affect cost, schedule, performance, quality, safety, reputation, benefits or other objectives.

Assessment framework

Define the criteria before scoring. An illustrative probability scale might be:

·       1 — Very low: <10%

·       2 — Low: 10% to below 30%

·       3 — Medium: 30% to below 50%

·       4 — High: 50% to 70% inclusive

·       5 — Very high: >70%

An illustrative schedule-impact scale might be:

·       1 — Minimal

·       2 — Minor local delay

·       3 — Material activity or milestone delay

·       4 — Major milestone threatened

·       5 — Project completion or critical objective threatened

The exact bands are organisation-specific. The important point is that the definitions are understood and consistently applied. Defined criteria reduce the likelihood that two people use the same number to mean completely different things.

State the exposure window for each probability assessment, such as the remaining procurement period, and compare ratings on an understood time basis. A monthly likelihood and a whole-project likelihood are not interchangeable. Define impact conditional on the event against the stated objective and reference; record exceptions before comparing scores.

3. Step-by-step method

1. Do not start by asking “What colour is the risk?” Start by asking what is actually known.

2. Confirm the cause, uncertain event and potential consequence.

3. Ask what evidence supports the probability assessment.

4. Identify which project objectives could be affected and how material the impact could be.

5. Consider timing: when might the risk occur and by when must a response decision be made?

6. Apply the agreed probability and impact criteria consistently.

7. Consider additional factors such as proximity or urgency where they genuinely improve prioritisation.

8. Challenge the initial rating and the evidence behind it.

9. Prioritise risks collectively, not simply one register row at a time.

10. Connect the analysis to responses, schedule, cost, contingency and management decisions.

11. Reassess residual exposure after credible actions are implemented or become effective.

4. Worked example

Reference Project risk: limited supplier manufacturing capacity may delay specialist equipment delivery, which could then delay installation and commissioning.

Assume probability = 4 (High) and schedule impact = 4 (Major milestone threatened). Multiplication gives a score of 16. For this exercise, the adopted matrix classifies 16 as high; the classification and response rules must be defined by the project and are not universal thresholds.

But that score is only the start of the analysis. Useful project-controls questions include:

·       What is the required delivery date?

·       Which activities depend on the equipment?

·       Is the delivery on or near the critical path?

·       How much float exists?

·       Can manufacture or transport be accelerated?

·       Is an alternative supplier feasible?

·       Can installation be resequenced?

·       What is the latest date for a management decision?

These questions connect the qualitative risk assessment to the actual project-control model rather than leaving it as an isolated register score.

Beyond the score

Two risks can have the same numerical score but have very different profiles. A high-probability/moderate-impact risk is not necessarily managed in the same way as a lower-probability/catastrophic-impact risk.

Additional factors may include proximity, urgency, velocity, detectability, persistence, interdependency, strategic importance and influenceability. Do not add extra dimensions simply to make the process look sophisticated; use them when they materially improve prioritisation or decision-making.

Prioritise collectively

The practitioner should consider the risk portfolio, not only individual scores. Ask which risks threaten critical objectives, which are urgent, which share common causes, which affect the same milestone, which could interact, which require management intervention and which can simply be monitored.

Challenge and bias

Ask what evidence supports the probability. If schedule impact is claimed, ask which milestone or activity is affected. If cost impact is claimed, ask for the basis. Common biases include optimism, anchoring, availability bias and group conformity. A structured process should reduce these biases rather than give them numerical authority.

Inherent and residual risk

Define the assessment basis. Inherent risk is assessed before controls; current residual risk reflects controls operating now; target residual risk is the expected position after further responses. State any different organisational convention. A supplier risk expected to move from 4×4 to 2×3 after protected production slots and staged deliveries is a target until the response is secured and its effectiveness supports reassessment.

Do not reduce a risk score merely because mitigation actions have been written in the register. Actions must be credible, funded, owned and implemented before the exposure is assumed to have changed.

Connect to the rest of project controls

Risks should connect where relevant to schedule activities and milestones, cost forecasts, contingency, change, assumptions, dependencies, actions and quantitative risk analysis. If a risk says it threatens a key milestone but no schedule linkage can be identified, the assessment should be challenged.

5. Interpretation and professional judgement

Qualitative analysis is a structured judgement process, not a mechanical calculation. The matrix supports consistency, but it does not replace professional reasoning. The practitioner should be able to explain why the rating is credible, why the risk matters now, and what management decision or action follows from the analysis.

The strongest analysis distinguishes evidence from assumption and recognises when a risk has become an issue. It also avoids false precision: a score of 16 is not scientifically “twice as risky” as a score of 8 simply because the arithmetic says so.

6. Practice diagnostic

Use this table to challenge the quality of the approach or deliverable. The rows consolidate the most important recurring red flags and checks; they are prompts for professional judgement rather than a substitute for the method above.

7. Try-it-yourself practical exercise

Identify five risks for the Reference Project. For each risk: write a cause–event–consequence description; define and apply probability and impact scales; place the risk on a matrix; rank or group the five risks; explain why the top two deserve management attention; identify response actions; reassess residual exposure; and explain the link to schedule, milestone or cost information where relevant.

Final challenge question: “Would management make a better decision because of this analysis?” If the answer is no, improve the analysis.

8. Bridge to capability

The How-to teaches how risks are assessed and prioritised qualitatively. At APPLIED and above, capability assessment should test whether the practitioner can apply and challenge criteria in a realistic project situation, recognise bias and connect the result to decisions. Evidenced ratings, collective priorities and justified residual exposure should substantiate the judgement. Supporting work products are illustrative and should be assessed with the practitioner’s reasoning. Sample learning questions illustrate the judgement at each recognition level; they are discussion prompts rather than validated assessment items.

Learning question: Do you understand how qualitative analysis supports risk prioritisation?

Capability question for APPLIED and above: Can you demonstrate and defend risk priorities, challenge weak scoring and explain the decision or response that follows?