Qualitative risk analysis includes methods for prioritizing the identified risks for further action, such as risk response.
The project members must revisit qualitative risk analysis during the project’s lifecycle. When the team repeats qualitative analysis for individual risks, trends may emerge in the results. These trends can indicate the need for more or less risk management action on particular risks or even show whether a risk mitigation plan is working.
Quantitative risk analysis is a way of numerically estimating the probability that a project will meet its cost and time objectives. Quantitative analysis is based on a simultaneous evaluation of the impact of all identified and quantified risks, using Monte Carlo simulation.
Quantitative risk analysis simulation starts with the model of the project and either its project schedule or its cost estimate, depending on the objective. The degree of uncertainty in each schedule activity and each line‐item cost element is represented by a probability distribution. The probability distribution is usually specified by determining the optimistic, the most likely, and the pessimistic values for the activity or cost element. This is typically called the “3‐point estimate.” The three points are estimated by the project team or other subject matter experts who focus on the schedule or cost elements one at a time.
Risk Response
Capturing risks, classifying them, prioritizing them, analyzing them is necessary to project success, but not sufficient.
Mitigating (handling) the risk is needed. This is done in one for four ways: †
-
Avoid. Risk can be avoided by removing the cause of the risk or executing the project in a different way while still aiming to achieve project objectives. Not all risks can be avoided or eliminated, and for others, this approach may be too expensive or time‐consuming. However, this should be the first strategy considered.
-
Transfer. Transferring risk involves finding another party who is willing to take responsibility for its management, and who will bear the liability of the risk should it occur. The aim is to ensure that the risk is owned and managed by the party best able to deal with it effectively. Risk transfer usually involves payment of a premium, and the cost‐effectiveness of this must be considered when deciding whether to adopt a transfer strategy.
-
Mitigate. Risk mitigation reduces the probability and/or impact of an adverse risk event to an acceptable threshold. Taking early action to reduce the probability and/or impact of a risk is often more effective than trying to repair the damage after the risk has occurred. Risk mitigation may require resources or time and thus presents a tradeoff between doing nothing versus the cost of mitigating the risk.
-
Acceptance. This strategy is adopted when it is not possible or practical to respond to the risk by the other strategies, or a response is not warranted by the importance of the risk. When the project manager and the project team decide to accept a risk, they are agreeing to address the risk if and when it occurs. A contingency plan, workaround plan and/or contingency reserve may be developed for that eventuality.
† Project Risk Management: A Scalable Approach, Risk Management Task Group, CalTrans, June 2012.
