Qualitative Risk Analysis can be one of the most effective ways to reduce project failure, schedule and budget overruns and just avoiding the shit that happens during the life of a project. Qualitative Risk Analysis offers an easy and effective way for businesses to improve their project risk management robustness without the need for heavy statistical analysis.
In a recent blog post I talked in general about the importance of project risk management in and listed several techniques that can be applied. This article outlines the process of qualitative risk analysis and shares a story where risk management saved one of my projects!
It can be too easy to not do risk management, perhaps you believe there is plenty of float in the schedule or contingency in the budget for risks and that you will be able to manage them on the fly… Sound familiar?
Allow me to share a story of a real project where risk management saved me and the project from massive failure.
On a recent project with a hard deadline (our client had contractual dates tied to external investment) we had a significant risk occur, a port strike in China which could have impacted the schedule by at least 3 weeks.
Fortunately, by using a qualitative risk analysis process this and many other risks were identified and planned for. Due to the extreme impact of this particular risk the project was structured from the beginning to accommodate it.
Long story short, when the risk occurred and our client panicked, we were able to demonstrate that we had considered the risk and had a plan of action should it occur. Our client took great comfort knowing the risk had been mitigated and our response strategy was already underway.
As a Project Manager, it is great feeling when a risk does occur which you have already considered and have a plan in place to manage it. I will never forget the look on our clients faces, they looked at us like we must have been psychic!
Here is another risk management success story from Shim, these are classic examples of risk management going well and something we all hope for in our projects. But these could have been a completely different story had we not have included qualitative risk management in our process.
This is how we do it.
Risk Management Need Not Be Difficult
For most, the term “risk management” or “risk analysis” sounds in itself complicated and lets face it, it can be a little daunting. But risk management does not need to be an over the top statistical analysis of probability and impact.
Qualitative risk analysis can make risk management much lighter, quicker and almost as effective as advanced quantitative risk analysis. I promise you, if you adopt these qualitative risk management techniques, you will have quite a robust project risk management system that can challenge the big players.
What Is Qualitative Risk Analysis
Qualitative risk analysis is simply the approach you take to analyse project risks, the impact these will have on the project and the probability of these risks occurring.
Qualitative risk analysis does not rely on data and statistics to base a model on. It uses the best judgement of your project team and project subject matter experts.
Benefits Of Qualitative Risk Analysis
- Easy to impliment
- All Stakeholders can be included
Qualitative Risk Analysis Process
As with anything that is worth doing, starting with a blank canvas, risk management can seem daunting, and the most effective way of dealing with a large task such as qualitative risk analysis, is to break it down into smaller steps:
1. Risk Identification
Identifying risks is arguably the most important part of the qualitative risk analysis process, if you have not identified any risks, it makes it pretty hard to manage said risks.
The trick to risk identification is to just start… Start thinking off anything that could go wrong, no matter how simple, obvious or trivial it seems. Capturing these obvious risks will start the mind working and will lead you deeper into more creative risks.
Risk identification is all about quantity, the more people involved the better – mind maps are a great tool for this.
2. Impact Analysis
Once you have identified a list of possible risks, the next step is to
analyse guesstimate what the potential impact could be. This simplicity is the beauty of qualitative risk analysis, there is no statistical model that relies heavily on the quality of the data that you plug in.
Using qualitative risk analysis, we simply
analyse estimate the impact on some kind of pre-defined scale (1-5) or (low-medium-high-extreme).
analyse estimate what the probability of this risk occurring is, again on a pre-defined scale (1-5) or (unlikely-possible-likely-almost certain).
These scores can then be combined to give a total risk ranking, which can be used for highlight reports etc.
3. Risk Treatment
Now that the risks have been identified with their impacts and probability scored, it is time to think about how to treat each risk. Risk treatment will generally by 1 of these 5 options:
Accept – perhaps the risk has low impact and low probability, or the cost to mitigate may be too high. One option is to just accept it and monitor the risk.
Transfer – Transferring a risk is quite common through insurance and contracts, issuing a contract to a supplier is essentially transferring some of the risk to the supplier, especially in a fixed price contract.
Mitigate - Do something to reduce the impact of the risk, we mitigated the risk of the Chinese port strike by having a backup plan in place and multiple tranches to build in extra capacity in the schedule
Avoid – Perhaps the risk is too great, cannot be transferred or the cost of mitigation it too high. You may choose to avoid the risk, either by changing or removing certain scope items or changing the approach.
Exploit – Perhaps the risk has a positive outcome? A change in the exchange rate might mean that your forward purchase certain materials.
4. Plan B
Have a plan of what to do, who gets notified and who does what
if when the risk event does occur. Most of the planning to this point is likely to be around minimising and transferring risks.
Knowing, documenting and agreeing on the course of action now, will save time and money and reduce the impact
if when the risk does occur. When the risk occurs, there should be no debate about what has to happen, it just gets done.
5. Review & Monitor
Risk management is never over. There should be constant review and updating of the risks, perhaps the impacts have changed or the risk is no longer a possibility, continually review and update the risk log.
Qualitative Risk Management Tools
As a project management consultant I often work with organisations and project teams to develop their project risk management capability and here are a few of the qualitative risk analysis techniques and tools that I have used with great success.
I love to mind map, I find I think better when I am not constrained by the linear layout of a spreadsheet and I generally find that identifying risks using a mind map generates many more ideas quicker than other techniques.
Mind mapping is also great for putting up on a projector and getting the entire room involved in the risk identification process. A great risk management mind mapping guide can here found here.
At some point you may start to run out of risks, or the idea generation may reduce greatly.
If when this occurs, I like to review each risk through different lenses, different angles.
By looking at a risk from different aspects of the project you will start to generate similar risks to other areas. For example, the risk of a port strike impacting on deliveries and the schedule, may also have a significant impact on costs or reputation or other projects…
At the very least try and consider the risks through the lense of each project component:
- Human Resources
Sending out a risk survey to offsite stakeholders or subject matter experts can be an effective way to identify risks and to capture the group consensus on each risks impact and likelihood scores.
I have found surveys to be most effective when used to capture impact and probability scores only. By listing the risks and providing a scoring scale, these can be completed quickly.
There may be key players that won’t be able to make qualitative risk analysis workshops or surveys, they may be external to the organisation and project, yet they may have valuable knowledge of past projects or be a subject matter expert.
Conducting short interviews can be a great way to extract the knowledge and incorporate their learnings into your qualitative risk analysis.
Risk Management Log
It sounds simple, and it is. But the fact is that many projects still do not maintain a risk management log.
The risk management log stores all the information regarding risk identification, impact analysis, response strategies and documented results. The risk log can be used to track risks that are imminent and to close out those that are no longer a risk of occurring.
There is much confusion about that difference between a risk and and issue. A risk is something that has not yet occurred but could, and issue is something that has occurred, whether it was identified as a risk or not.
If a risk occurs and becomes an issue, capture it on an issue log. Identify the strategy taken to overcome the issue, why it occurred and how affect the management strategy was.
This information will become invaluable in future projects and risk analysis.
I hope this overview of the qualitative risk analysis process has proven that risk management need not be difficult or complex. These techniques may seem simple on the surface, but I guarantee that if you follow them, you will be using a risk management framework that is much more robust than before and aligned with best practice.
Do you have a story where effective risk management has saved your project, leave it in the comments below?