Risk Assessment — Identification & Qualitative Analysis

What risk assessment is

Assessment is the first analytical stage of the risk cycle from Lesson 1. It's mostly qualitative: it doesn't yet model numbers (that's quantitative analysis, later in the track) — it surfaces risks and ranks them by judgment so the team knows where to focus. For many projects, qualitative assessment is all the analysis they need.

Identifying risks

You can only manage risks you've found, so identification aims to be thorough. The main techniques:

• Workshops & brainstorming — Bring the team together to surface risks from many perspectives — the most common and powerful method.
• Checklists & risk breakdown structures — Standard lists of risk categories ensure common risks aren't overlooked.
• Lessons learned & historical data — What went wrong on past similar projects — risks that recur are easy to anticipate.
• Expert interviews — Experienced people often know the risks a checklist misses.

The probability-impact matrix

Qualitative analysis rates each risk on two scales — how likely and how big — and combines them into a priority. The classic tool is the risk matrix. Set probability and impact to see where a risk lands:

The limits of the matrix

Two more cautions: the ratings are subjective, so calibrate them with clear, agreed scales (what does "impact 4" actually mean in days or dollars?); and beware the matrix's blind spot — a low-probability, catastrophic risk can score "medium" yet be the one that sinks the project. Always look past the score at the genuinely existential risks.

Ten things to remember

1. Risk assessment = identification + qualitative analysis → a ranked register.
2. Identify widely, prioritize ruthlessly — wide net, then sharp filter.
3. Use workshops, checklists, lessons learned, and expert input to find risks.
4. State risks as cause → event → effect — vague one-word risks can't be managed.
5. Qualitative analysis rates probability × impact on agreed scales.
6. The risk score sorts the register — reds get treated, greens get monitored.
7. The matrix ranks, it doesn't quantify — the score isn't dollars or days.
8. Ratings are subjective — calibrate with clear scales for probability and impact.
9. Watch the low-probability/catastrophic risk — it can score "medium" yet sink the project.
10. Qualitative often suffices — go quantitative only when the stakes warrant it.