risk 1

As Dan Quayle said: “If we don’t succeed we run the risk of failure!” 

Qualitative Risk Analysis is the method used by the vast majority of projects to prioritize risk, and it leverages its two components: 

  • Probability – how likely is the event to occur
  • Impact – what will happen if the event occurs

Qualitative Risk Analysis is designed to assign relative weighting to identified risks and group them together logically so that response strategies can be developed and applied. 

The Project Manager (PM) is not a subject matter expert – they are a process expert.  This is why establishing governance over all processes in the Planning Phase is crucial.  The decision to use Qualitative Risk Analysis and the supporting processes should have been documented at that time.

It is also important to remember that for the PM, risk presents as variance from the plan – both positive and negative.  If your project comes in dramatically under budget and ahead of schedule, that is also a “failure”.  The resources and time allocated to your project weren’t accurate and could have been deployed elsewhere.

That can have significant organizational impact.

 So how does Qualitative Risk Analysis work??

As risks are identified they are assigned to experts for assessment.  How to “score” the risks is described in the Risk Assessment Matrix which.  The Y-axis lists those items of strategic importance and typically include scope, cost, schedule and quality – however I have seen items like “reputation” and “regulatory” also be included.  The X-axis contains the PM’s guidance on how to weight probability and impact so that the agreed upon view of risk is reflected in the analysis. 

This isn’t difficult at all!  You look at a risk and determine that it would have an impact on the schedule. You know that “schedule” is important as a strategic priority, so you assign it to the experts best able to assess the impact.  They score it based on the criteria you provided them Risk Assessment Matrix.  That’s it!

The Risk Assessment Matrix is a crucial tool to compensate for the risk/reward bias described in the Utility Theory.   

There are many examples of how to do this on the internet, so chose the format that works best for your organization. 

 The identified risks have now been “scored” by the experts based on the guidance you provided.  The next step is to array them on a Probability and Impact Matrix.  Here is an example:

risk 2

Source PMBOK® Guide, page 331, figure 11-10

Risks are placed into 4 broad categories based on their scores.  Looking at the chart above, you can see the risks that score in the top right have the greatest probability of occurring and have the greatest impact, while those in the bottom left have the least chance of occurring and the smallest impact.  The 4 broad categories are:

  • High probability, high impact – it probably will occur and it will be awful
  • High probability, low impact – it will probably occur, but it won’t be too bad
  • Low probability, high impact – it probably won’t occur, but if it does it will be awful
  • Low probability, low impact – it probably won’t occur, and if it does it won’t be too bad

Placing risk into these categories is important because there are specific response strategies for each grouping.  I have been asked many times “what is your mitigation strategy?”.  Mitigation is not the proper response to every type of risk!  I will cover this in a later post.

Please note that the chart above only represents ½ of the total matrix and focuses on negative risk, while the PM should also be on the lookout for exploitable opportunities!  Remember, for the PM risk really about variance from the Project Plan.

The benefits of Qualitative Risk Analysis are that it is intuitive, and most organizations use it!   Anyone who has watched a meteorologist describe the path of a hurricane can understand this process.  It also provides a great basis for initial risk assessment and is often what is intuitively used in the early phases of the project.

 There are three key weaknesses. 

  • Like all estimates it is still an educated guess based on expert opinion.  Is there a 10% chance or a 20% chance?  Hard to pin that down!
  • The output (the categories above) don’t support more sophisticated computer modeling.
  • It doesn’t provide you with a monetary value of the impact, so there needs to be a secondary analysis to determine how much “high impact” could cost you!

Quantitative Risk Analysis solves two of those problems, and we will discuss that next time.


Tell me your thoughts in the comments and let’s open a dialog. I would be excited to hear other opinions on this topic.

Consider joining our LinkedIn Group to continue this conversation as well - CLICK HERE
We hope you will consider joining our Facebook Community as well.  Click on the image to your left to visit and join, or you can CLICK HERE




Reading this article qualifies you to submit a request for PDU’s from PMI.

This Article qualifies as follows:



For more information on registering your PDU’s with PMI – CLICK HERE


At Project Management for Today, we encourage conversation; agree with us or disagree with us, it’s all still knowledge, and we are here to share knowledge. Take a moment to add to the conversation by leaving a comment. It’s an opportunity to engage in the conversation!

If you believe in what we are doing, take a minute to share our articles on your social networks such as LinkedIn and other sites. Use the buttons on the left side of the page.

This article features content from a “Contributing Author” to the Project Management for Today Community. This content is published on this site with the author’s explicit permission. As with all articles on this site, this article is protected by copyright. If you are interested in becoming a Contributing Author to this site, you can learn more by reading the information HERE


You may republish this article in whole or in part with attribution to the author and a direct link back to the full article on this site. Attributions MUST include a hyperlink to the original article, as well as a "Canonical Link" reference embedded in the <head> section of the page.
#pmfortoday / #projectmanagement / #pdu / #pmi / #pmo / #pmbok / #pmblog / #pmoblog / #pmp / #pmi-acp / #pgmp


Bill Holmes

Bill Holmes

Contributing Author

Bill has been an Executive in the Federal Sector for over 15 years and has been responsible for the delivery of many high profile, high risk, public facing projects.  He has worked for the same organization for 28 years, starting as a front-line technician and rising quickly to the rank of Executive.

He holds numerous trademarks and is the inventor and Unites States Patent holder of the SeaClutch®, an invention targeted at the boating and RV community. 

Bill is a sought-after speaker and has spoken at conferences around the world.  He is a published author in the field of Project Management, is an experienced Project Management Professional® certification instructor, and has successfully taught hundreds of students over the past several years.

He received his Bachelor’s Degree in Economics and Finance from Augusta State University and was named one of their Distinguished Alumni in 2016.  He holds Master’s Certificates in both Project and Program Management from George Washington University, and is a Senior Executive Fellow at the Kennedy School of Government, Harvard University.  He holds the following professional certifications:  Project Management Professional (PMP), Program Management Professional (PgMP), Project Management Institute Agile Certified Practitioner (PIM-ACP), Project Management Institute Risk Management Professional (PMI-RMP).

Bill is an acknowledged international expert in Data Management, Data Safeguards and Data Analytics.

He has extensive international experience and has worked closely with representatives from multiple jurisdictions around the world, personally visiting over 40 in an official capacity.


LinkedIn Profile – CLICK HERE
LinkedIn Group – CLICK HERE
Articles by Bill Holmes – CLICK HERE

Advertisements B