Project Risk Management Using Qualitative Risk Analysis

Project Risk Management Using Qualitative Risk Analysis

Qualitative Risk Analysis can be one of the most effective ways to reduce project failure, schedule and budget overruns and just avoiding the shit that happens during the life of a project. Qualitative Risk Analysis offers an easy and effective way for businesses to improve their project risk management robustness without the need for heavy statistical analysis.

In a recent blog post I talked in general about the importance of project risk management in and listed several techniques that can be applied. This article outlines the process of qualitative risk analysis and shares a story where risk management saved one of my projects!

Importance Of Project Risk ManagementImage of the Qualitative Risk Analysis Process

It can be too easy to not do risk management, perhaps you believe there is plenty of float in the schedule or contingency in the budget for risks and that you will be able to manage them on the fly… Sound familiar?

Allow me to share a story of a real project where risk management saved me and the project from massive failure.

On a recent project with a hard deadline (our client had contractual dates tied to external investment) we had a significant risk occur, a port strike in China which could have impacted the schedule by at least 3 weeks.

Fortunately, by using a qualitative risk analysis process this and many other risks were identified and planned for. Due to the extreme impact of this particular risk the project was structured from the beginning to accommodate it.

Long story short, when the risk occurred and our client panicked, we were able to demonstrate that we had considered the risk and had a plan of action should it occur. Our client took great comfort knowing the risk had been mitigated and our response strategy was already underway.

As a Project Manager, it is great feeling when a risk does occur which you have already considered and have a plan in place to manage it. I will never forget the look on our clients faces, they looked at us like we must have been psychic!

Here is another risk management success story from Shim, these are classic examples of risk management going well and something we all hope for in our projects. But these could have been a completely different story had we not have included qualitative risk management in our process.

This is how we do it.

Download our Qualitative Risk Analysis by clicking the plus +1

Risk Management Need Not Be Difficult

For most, the term “risk management” or “risk analysis” sounds in itself complicated and lets face it, it can be a little daunting. But risk management does not need to be an over the top statistical analysis of probability and impact.

Qualitative risk analysis can make risk management much lighter, quicker and almost as effective as advanced quantitative risk analysis. I promise you, if you adopt these qualitative risk management techniques, you will have quite a robust project risk management system that can challenge the big players.

What Is Qualitative Risk Analysis

Qualitative risk analysis is simply the approach you take to analyse project risks, the impact these will have on the project and the probability of these risks occurring.

Qualitative risk analysis does not rely on data and statistics to base a model on. It uses the best judgement of your project team and project subject matter experts.

Benefits Of Qualitative Risk Analysis

  • Speed
  • Accuracy
  • Preparedness
  • Easy to impliment
  • Effective
  • All Stakeholders can be included

Qualitative Risk Analysis Process

As with anything that is worth doing, starting with a blank canvas, risk management can seem daunting, and the most effective way of dealing with a large task such as qualitative risk analysis, is to break it down into smaller steps:

1. Risk Identification

Identifying risks is arguably the most important part of the qualitative risk analysis process, if you have not identified any risks, it makes it pretty hard to manage said risks.

The trick to risk identification is to just start… Start thinking off anything that could go wrong, no matter how simple, obvious or trivial it seems. Capturing these obvious risks will start the mind working and will lead you deeper into more creative risks.

Risk identification is all about quantity, the more people involved the better – mind maps are a great tool for this.

2. Impact Analysis

Once you have identified a list of possible risks, the next step is to analyse guesstimate what the potential impact could be. This simplicity is the beauty of qualitative risk analysis, there is no statistical model that relies heavily on the quality of the data that you plug in.

Using qualitative risk analysis, we simply analyse estimate the impact on some kind of pre-defined scale (1-5) or (low-medium-high-extreme).

We then analyse estimate what the probability of this risk occurring is, again on a pre-defined scale (1-5) or (unlikely-possible-likely-almost certain).

These scores can then be combined to give a total risk ranking, which can be used for highlight reports etc.

3. Risk Treatment

Now that the risks have been identified with their impacts and probability scored, it is time to think about how to treat each risk. Risk treatment will generally by 1 of these 5 options:

  • accept
  • transfer
  • mitigate
  • avoid
  • exploit

Accept – perhaps the risk has low impact and low probability, or the cost to mitigate may be too high. One option is to just accept it and monitor the risk.
Transfer –
Transferring a risk is quite common through insurance and contracts, issuing a contract to a supplier is essentially transferring some of the risk to the supplier, especially in a fixed price contract.
Mitigate  -
Do something to reduce the impact of the risk, we mitigated the risk of the Chinese port strike by having a backup plan in place and multiple tranches to build in extra capacity in the schedule
Avoid –
Perhaps the risk is too great, cannot be transferred or the cost of mitigation it too high. You may choose to avoid the risk, either by changing or removing certain scope items or changing the approach.
Exploit –
Perhaps the risk has a positive outcome? A change in the exchange rate might mean that your forward purchase certain materials.

4. Plan B

Have a plan of what to do, who gets notified and who does what if when the risk event does occur. Most of the planning to this point is likely to be around minimising and transferring risks.

Knowing, documenting and agreeing on the course of action now, will save time and money and reduce the impact if when the risk does occur. When the risk occurs, there should be no debate about what has to happen, it just gets done.

5. Review & Monitor

Risk management is never over. There should be constant review and updating of the risks, perhaps the impacts have changed or the risk is no longer a possibility, continually review and update the risk log.

SPM Newsletter

Find out how to manage more projects while working less!

Qualitative Risk Management Tools

As a project management consultant I often work with organisations and project teams to develop their project risk management capability and here are a few of the qualitative risk analysis techniques and tools that I have used with great success.

Mind Map

I love to mind map, I find I think better when I am not constrained by the linear layout of a spreadsheet and I generally find that identifying risks using a mind map generates many more ideas quicker than other techniques.

Mind mapping is also great for putting up on a projector and getting the entire room involved in the risk identification process. A great risk management mind mapping guide can here found here.

Mind Map being used for qualitative risk analysis


At some point you may start to run out of risks, or the idea generation may reduce greatly. If when this occurs, I like to review each risk through different lenses, different angles.

By looking at a risk from different aspects of the project you will start to generate similar risks to other areas. For example, the risk of a port strike impacting on deliveries and the schedule, may also have a significant impact on costs or reputation or other projects…

At the very least try and consider the risks through the lense of each project component:

  • Scope
  • Time
  • Cost
  • Quality
  • Risk
  • Communication
  • Human Resources
  • Procurement
  • Integration


Sending out a risk survey to offsite stakeholders or subject matter experts can be an effective way to identify risks and to capture the group consensus on each risks impact and likelihood scores.

I have found surveys to be most effective when used to capture impact and probability scores only. By listing the risks and providing a scoring scale, these can be completed quickly.

Surveymonkey and google docs are great tools for this.


There may be key players that won’t be able to make qualitative risk analysis workshops or surveys, they may be external to the organisation and project, yet they may have valuable knowledge of past projects or be a subject matter expert.

Conducting short interviews can be a great way to extract the knowledge and incorporate their learnings into your qualitative risk analysis.

Risk Management Log

It sounds simple, and it is. But the fact is that many projects still do not maintain a risk management log.

The risk management log stores all the information regarding risk identification, impact analysis, response strategies and documented results. The risk log can be used to track risks that are imminent and to close out those that are no longer a risk of occurring.

Issues Log

There is much confusion about that difference between a risk and and issue. A risk is something that has not yet occurred but could, and issue is something that has occurred, whether it was identified as a risk or not.

If a risk occurs and becomes an issue, capture it on an issue log. Identify the strategy taken to overcome the issue, why it occurred and how affect the management strategy was.

This information will become invaluable in future projects and risk analysis.

I hope this overview of the qualitative risk analysis process has proven that risk management need not be difficult or complex. These techniques may seem simple on the surface, but I guarantee that if you follow them, you will be using a risk management framework that is much more robust than before and aligned with best practice.

Do you have a story where effective risk management has saved your project, leave it in the comments below?


Join tons of other people who receive exclusive updates every time I release new information...

Who Wrote This Article? ...(It was: Chris O'Halloran)

I'm "Chris O". I've managed hundreds of millions of dollars worth of projects since the inception of my career. I love helping others figure out the intricacies of project management on any scale. Come find me on twitter or google+

Comments That Have Been Left So Far:

  1. Marilie Rodriguez said:

    It seems so easy but based on our studies, it is difficult to identify risk. I find your article veryhelpful

    • Thanks for your kind words and spending your time visiting my blog. If you are finding it difficult to identify risks, can I suggest that you gather your team in a room and just start brainstorming everything and anything that can go wrong.

      Considering you have taken the time to read my article (which is quite long) on a dry topic such as Risk Management, I am happy to spend 30 minutes of my time over Skype with yourself and your team to give you some ideas on Risk Management at no cost. If you would like to schedule some time, then you can contact me through my contact page.

  2. project risk management is one of the potentially valuable yet under practiced elements of project management today – it needs to be understood better and then maybe practice will follow

Comment Policy: Feel free to say what you wish, bicker with other people, and even use a curse word or two when it's appropriate... But, use more than one link, and we'll have to delete your comment.

These Sites Sent Their Link Love:

  1. [...] this post I discovered that Chris O’Halloran published a post with a similar message (see HERE). [...]

  2. […] Project Risk Management Using Qualitative Risk Analysis read Risk […]

  3. […] A Risk Management Plan is simply a document that outlines the rules of how you will manage the risks of the project. It will often reference the organisations risk appetite, to ensure alignment with the business and possibly aligned to a best practice or international standard such as ISO:31000. Here is my approach to Risk Management. […]

  4. […] improve project management is to tightly monitor and control project risks. Don’t be scared of risk management, it is one of the most critical components to a successful project, effective risk management helps […]

Leaving Comments Is The Only Way To Speak Your Mind...