Risk Assessment and Analysis

Risk Scoring

The process of identifying the probability and severity of a risk, multiplying them together to determine overall risk.

Perform Quantitative Risk Analysis -

The process of numerically analyzing the effect of identified risks on overall project objectives. The Perform Quantitative Risk Analysis is where the intense number crunching analysis occurs. The goal is to be able to evaluate the cumulative ("aggregate") effect on project outcomes for all individual risks. It's the only way to reliably assess the overall project risk level. It will take a lot of work, thousands of simulations, and usually performed using computer software by someone with risk analysis expertise.

Perform Qualitative Risk Analysis

The process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact. The Perform Qualitative Risk Analysis process helps you prioritize risks for further analysis and response development. A risk may impact one or more project objectives such as schedule, scope, budget, or quality. As you prioritize risks, you'll align the priority with the project objective priority.

Components of a risk statement

The word "if." Remember that all risks are in the future and not all risks that are identified will occur. So, the word "if" should start your risk statement. The specific risk event or condition. What is it that you are concerned about? Be specific. Remember, weather is a fact, not a risk. The specific weather you are concerned about is, for example, extreme temperature or condition such as excessive rain. The specific consequence of that risk occurring on a specific work effort or project objective Ie: If we experience more than five consecutive rain days in May when we are scheduled to pour the foundation, the cascade effect on the schedule will result in an estimated 20% delay of construction completion.

Representations of Uncertainity

Then how do we explain and demonstrate this level of project uncertainty resulting from the risks we've identified to our project stakeholders? We need to let them know what we've learned so they can make the business decisions regarding our project with the best information we can provide. Just remember that when you created the risk management plan, one component you may have documented was the stakeholders' risk tolerance and thresholds. Your ability to perform quantitative analysis provides you the opportunity to confirm if the level of uncertainty and risk is within those tolerance levels.

Descison making under uncertanity

This is specific decision-making process terminology related to the amount of information known at the time of decision. It looks like this:

Which statement below best describes the Perform Qualitative Analysis process?

This process utilizes the probability-impact matrix to develop risk scores for individual risks.

Probability-Impact Matrix

A PI matrix provides an easy way to score risks, so we can determine priority. The intersecting cell of the probability (rows) and impacts (columns) represents the risk score. The lowest possible score is in the lower left corner of the matrix and the highest possible score is in the upper right corner of the matrix.

Sensitivity Analysis

A quantitative risk analysis and modeling technique used to help determine which risks have the most potential impact on the project. It examines the extent to which the uncertainty of each project element affects the objective being examined when all other uncertain elements are held at their baseline values. The typical display of results is in the form of a tornado diagram. Sensitivity analysis will help you identify which individual risks have the most potential impact on your project objectives. You're able to test how much an outcome changes when you alter one or more variables. The risks that have the greatest potential impact are considered most sensitive.

Question 3, Correct, Multiple Choice The risk register is an output of the ______ risk management process.

Identify Risks

Which statement best describes risk?

Risks are future events that, if one occurs, will impact one or more project objectives.

A tornado diagram is associated with which quantitative analysis tool?

Sensitivity analysis

Simulation

Simulations can be used to map out uncertainty by calculating the impact of different combinations of individual risks on the project objectives. Once you develop a model, you can manipulate certain variables to measure the effects of changes. With a simulation, you systematically explore different scenarios and establish a range of possible outcomes. You can use software to calculate thousands of iterations.

Tornado Diagrams

Tornado diagrams are one form of sensitivity chart used to display the results of sensitivity analysis. They graphically display the range of possible outcomes. The wider the range, the more variability (sensitivity). A tornado diagram gets its name because it's shaped like a tornado with the widest bars at the top and smallest ones at the bottom

Other than probability and impact what other deminsions may determine priority

Urgency: the amount of lead time you have between the time when the risk was identified and the time when a response must be implemented. High urgency may increase priority. Controllability: the degree to which the risk outcome can be controlled. Risks that can't be controlled may be considered higher priority because the need to develop responses increases. Connectivity: the number of other risks this risk is connected to. If this risk can impact other risks, the probability of a cascade (or domino) effect is higher. It may be considered a higher priority because the need to develop responses increases.

Qualitative analysis outputs

has only one output: updates project documents. This includes your assumptions and issue logs as well as the risk register. The risk register should be populated with additional dimensions (parameters) and the risk category for each risk. That will allow you to sort risks based on the project's primary objective or driver (schedule, cost, scope, etc.). The goal of Perform Qualitative Analysis is to have a prioritized list of risks. In accordance with the risk definitions in the risk management plan, you'll know which risks are required to undergo further analysis.

Risk Overview

we talked about the risk management plan, how to identify risks, and then the process of analyzing them. Now that you have your prioritized list of risks, it's time to develop risk responses. All risks have two things in common: They are a future event, and there's no guarantee any risk will occur. That's the uncertainty part of the problem. It would not be practical to plan risk responses to all risks, which is why we have our prioritized list. Now we can focus our attention on those risks that have the greatest potential to impact our project objectives. Always keep in mind that any risk could have a positive or a negative impact. Our planned responses will by appropriate for the situation.

Monte Carlo Analysis

technique that performs a large number of trial runs of a particular portfolio mix of investments, called simulations, to find an optimal allocation for a particular investor's goals and risk tolerance The concept of Monte Carlo analysis is associated with simulations. Monte Carlo analysis performs many iterations to produce distributions of possible outcome values that can't be easily predicted due to random variables. As used here, the random variables are the effect of different combinations of individual risks. Once you've completed the quantitative risk analysis, you'll need to document your findings and share them with the stakeholders. This information will be used in decision making.

TIP - qualitative vs Quantative risk analysis

After risks have been identified, you'll need to assess them. In an ideal world, you'd also want to analyze each and every one of them. The reality is, you don't have that kind of time. So, you'll have to develop a way to prioritize risks. Only those risks with the highest priority will be analyzed. There are two risk analysis processes: Perform Risk Qualitative Analysis and Perform Risk Quantitative Analysis. Generally speaking, qualitative analysis will precede quantitative analysis. It's through qualitative analysis that you'll prioritize individual risks and determine which risks require further analysis. Quantitative analysis is where the real number crunching occurs.It's also responsible for evaluating the cumulative effect of multiple risks.

Decision Tree Analysis

Another type of sensitivity analysis Decision tree analysis supports the decision-making process by diagramming out all alternatives and their outcomes. There are two possibilities at each branch node. It's either a decision point or a chance event. Decisions use a square icon and chance events use a circle to differentiate them. Any time there is a branching, probabilities are distributed between the branches. The total of the branches must equal 100% so all options are included. Decision trees can also be used as probability trees. Let's assume there is a 50% probability that we'll either develop the new functionality in-house or buy it commercially. On the exam, you might be asked to calculate the probability of one particular outcome. For example, what is the probability of developing it in-house (50%) and getting good results (60%)?

PI Rule of Thumb

Probability x Impact = Risk Score3 x 4 = 124 x 3 = 12 The rule of thumb when prioritizing this situation is, "Impact trumps probability." So, the risk with the impact score of 4 would be a slightly higher priority than the risk with the impact score of 3. The legend definitions are documented in the risk management plan. In addition, the risk management plan documents the definition of "high," "medium," and "low" risks. Using the PI matrix here, "high" could be a risk score greater than 10, and "low" could be a risk score less than 6, and anything in between would be "medium."

Where is the risk breakdown structure (RBS) documented?

Risk management plan

Risk watch list

Those Risk that are not of enough concern to perform quantiative analysis on. they are identified in the Qualitative Analysis process.