Qualitative Project Risk Analysis

Why You Cannot Treat Every Risk Equally

A complex defence programme might identify 200 or more individual risks during the Identify Risks process. A project manager who attempts to develop detailed response strategies for every single one will exhaust the team's time, budget, and attention — accomplishing nothing well while attempting everything. The corresponding activity in the earlier process model — Perform Qualitative Risk Analysis — exists to solve this problem. It separates the critical few from the trivial many, enabling focused allocation of management attention and contingency resources to the risks that matter most.

Qualitative risk analysis assesses each risk in terms of its probability of occurrence and impact on project objectives, using the definitions and scales established in the Risk Management Plan. The result is a prioritised risk list that tells the project manager where to focus — which risks demand immediate, aggressive response planning, which should be monitored on a watch list, and which warrant further quantitative analysis.

What Is the corresponding activity in the earlier process model — Perform Qualitative Risk Analysis?

The process takes the raw risk register from the corresponding activity in the earlier process model, applies six assessment tools, and produces an updated register with priority rankings, category groupings, urgency classifications, and trend data.

How It Works: Six Tools and Techniques

1. Risk Probability and Impact Assessment

Each risk in the register is assessed on two dimensions:

Risk Probability — the likelihood that the risk event will occur. This is expressed using the probability scale defined in the Risk Management Plan (e.g., Very Low / Low / Medium / High / Very High, or numerical values like 0.10, 0.25, 0.50, 0.75, 0.90). Risk Impact — the potential effect on project objectives (scope, schedule, cost, quality) if the risk event does occur. This is expressed using the impact scale defined in the Risk Management Plan.

Both the probability and impact are assigned scores according to the pre-defined scales in the Risk Management Plan. These scores are then combined — typically by multiplication — to produce a risk score that enables ranking and prioritisation.

$$\text{Risk Score} = \text{Probability} \times \text{Impact}$$

For example, a risk with a probability of 0.50 (Medium) and an impact of 0.80 (Very High) would receive a risk score of:

$$\text{Risk Score} = 0.50 \times 0.80 = 0.40$$

2. Probability and Impact Matrix (PIM)

The PIM is the core tool of qualitative analysis. It maps every combination of probability and impact to a risk rating — typically using a colour-coded grid that visually separates extreme, high, moderate, and low-priority risks.

The PMBOK® Guide provides a standard matrix format that addresses both threats and opportunities: Threats (Negative Risks):

The specific thresholds that separate the risk rating zones are set by the organisation during the corresponding activity in the earlier process model (Plan Risk Management), not during the analysis itself. This ensures consistency across assessors and prevents individual biases from distorting the prioritisation.

Applying the Matrix: A Defence Manufacturing Example

Consider three risks identified on an armoured vehicle upgrade programme:

R-003 and R-005 move into the priority zone for detailed response planning. R-004 goes onto the watch list.

3. Risk Data Quality Assessment

Before trusting the probability and impact assessments, the team must evaluate the quality of the data underlying those assessments. This involves examining:

If the data quality for a particular risk is unacceptable — for example, if the probability estimate is based on no historical precedent and no expert input — the team may need to gather additional information before the assessment can be considered reliable. In practice, low-quality assessments are flagged and targeted for deeper investigation, often through expert interviews or analogy-based estimation from similar programmes.

4. Risk Categorisation

Grouping risks by their RBS category — technical, programmatic, supply chain, regulatory, etc. — reveals patterns that may not be visible when risks are examined individually. If the qualitative analysis reveals that 60% of the high-priority risks fall within the "Supply Chain" category, this signals a systemic vulnerability that warrants a holistic response strategy (e.g., a comprehensive supplier development programme) rather than individual risk-by-risk responses.

5. Risk Urgency Assessment

Not all risks demand immediate attention. A risk with a high probability and high impact that could materialise next week is qualitatively different from an equally severe risk whose trigger window is eighteen months away. Risk urgency assessment considers the time available to affect a risk response and the proximity of the risk event.

Urgency indicators include:

• Time required to implement a risk response (a response needing 6 months of lead time must be triggered 6 months before the risk event)
• Proximity of the risk trigger to the current project phase
• Whether the risk exists on or near the critical path
• Whether the risk affects upcoming milestone reviews or customer decision points

In some qualitative approaches, urgency is combined with the probability-impact score to produce a final risk severity rating — a three-dimensional assessment that captures how bad, how likely, and how soon.

6. Expert Judgment

Expert judgment in qualitative analysis relates specifically to assessing the probability and impact of individual risks. Experts with experience of similar projects can provide calibrated estimates where historical data is unavailable — which is frequently the case for novel defence systems.

How It Works: Outputs — Project Documents Updates

The primary output is an updated Risk Register enriched with the following information: Relative ranking or priority list of project risks — risks classified by individual significance using the probability and impact matrix. Risks may be listed by priority separately for schedule, cost, and performance, since organisations may value one objective over another. Risks grouped by categories — pointing to common underlying causes that may suggest holistic response strategies. Discovering concentrations of risk can improve the effectiveness of risk responses by addressing root causes rather than individual symptoms. List of risks requiring near-term response — those risks whose urgency assessment indicates that action must be taken immediately, separated from those that can be addressed at a later date. List of risks for additional analysis — some risks may warrant further quantitative analysis (the corresponding activity in the earlier process model) before response strategies can be developed. These are flagged for escalation to Monte Carlo simulation, EMV analysis, or decision tree analysis. Watch lists of low-priority risks — those not assessed as significant are placed on a monitoring list. They are not forgotten — they are tracked at a lower frequency and reviewed for any changes in probability, impact, or urgency. Trends in analysis results — because qualitative analysis is iterative, trends for particular types of risk may become apparent over time. An increasing concentration of high-priority risks in a specific category signals a developing systemic issue.

Qualitative vs Quantitative: Understanding the Boundary

Qualitative analysis uses descriptive scales (High/Medium/Low) and subjective expert judgment to assess probability and impact. It is relatively fast, inexpensive, and applicable to all projects regardless of size or data availability.

Quantitative analysis (the corresponding activity in the earlier process model) uses numerical data, statistical techniques, and mathematical models (Monte Carlo simulation, decision trees, sensitivity analysis) to calculate precise probability distributions and expected monetary values.

In defence and heavy engineering, the rule of thumb is: always perform qualitative analysis to prioritise the risk register, then selectively apply quantitative analysis to the highest-priority risks and to the overall project schedule and cost confidence assessment.

Common Pitfalls

Treating qualitative analysis as precise measurement. A risk score of 0.40 is not meaningfully different from 0.42. Qualitative analysis produces ordinal rankings (first, second, third priority), not precise cardinal measurements. Over-engineering the scoring system creates false precision that undermines trust in the process. Allowing bias to dominate. Optimism bias, anchoring to previous assessments, and groupthink can systematically distort probability and impact ratings. Using structured techniques like the Delphi method, independent pre-meeting assessments, and explicit bias awareness training helps mitigate these distortions. Failing to reassess. Qualitative analysis must be repeated regularly because risk profiles change as the project progresses. A risk rated "Low" during design may become "High" during integration as the trigger window narrows. Ignoring opportunities. The probability and impact matrix applies to both threats and opportunities. Teams that only assess downside risks miss the chance to proactively pursue upside scenarios. Inconsistent use of scales. If different assessors interpret "High probability" differently — one meaning 60% and another meaning 90% — the resulting prioritisation is meaningless. This is why the corresponding activity in the earlier process model must define these scales explicitly.

Key Takeaways

• Qualitative Risk Analysis (11.3) prioritises risks by assessing their probability and impact using pre-defined scales, producing an ordinal ranking that separates the critical few from the trivial many.

• The Probability and Impact Matrix (PIM) is the core tool — it maps probability-impact combinations to risk ratings that drive management response.

• Risk Data Quality Assessment ensures that assessments are based on reliable information, not guesswork or bias.

• Risk Categorisation reveals patterns and concentrations that may warrant systemic rather than individual responses.

• Risk Urgency Assessment adds a time dimension — how soon could the risk materialise, and how long would the response take to implement?

• The risk score formula is: $$\text{Risk Score} = \text{Probability} \times \text{Impact}$$