Locked lesson.
About this lesson
All project risks are not equal in their effect on a project. Project risks that have been identified are prioritized using qualitative techniques such as the Risk Matrix.
Exercise files
Download this lesson’s related exercise files.
Risk Matrix.docx60.9 KB Risk Matrix - Solution.docx
106.9 KB
Quick reference
Risk Matrix and Qualitative Risk Analysis
Project risks are not equal in their effect on a project. Project risks that have been identified are prioritized using qualitative techniques such as the Risk Matrix.
When to use
Once project risks have been identified, they should be entered onto a matrix or qualitative assessment and prioritized for further action. As long as there are open risks on the project, a risk matrix should be used.
Instructions
- Determine the size of the matrix – the most commonly used size is 3 X 3. But I have worked with 4 X 4, 5 X 5, and even a 5 X 10 that combined positive and negative risk in one matrix.
- Normally probability is set as the vertical axis. The scale is either low to high or it is set with probability values
- Normally project impact is set as the horizontal axis. The scale is either low to high or an impact in terms of money or time is set.
- For each risk, place it in the correct spot on the matrix based upon the probability that the risk will occur and the impact to the project if it does occur.
- I use recent relevant experience on similar projects to assess the probability. If it happened on each of the last five projects, the probability is high that it will occur again. If it hasn’t happened on any of the last five projects, the probability is low.
- I base the impact assessment on the current project plan. Assuming the risk occurs, what does it do to the plan and the ability to achieve the project objectives? Is it a minor irritant or does the plan already account for the risk – then the impact is low. Does it require a totally new approach and a project rebaseline – then the impact is high.
- Periodically update the risks as more information becomes available and as events occur within the project.
- If you implement risk mitigation or risk response action in the project, the risk will normally be repositioned in the matrix – either the probability is reduced or the impact is decreased.
- If you accept a challenge or change to project objectives (finish one month sooner) normally some risks will need to change position, either the probability increases or the impact increases.
- Based upon the location of the risk in the matrix, the risk often receives a colour code. Risk with high probability and high impact are red. Risks with low probability and impact receive a color code of green. Risks in the middle receive a colour code of yellow.
- 00:04 Hello, I'm Ray Sheen.
- 00:06 And I'd like to talk about analyzing risk in order to prioritize them.
- 00:10 We call this qualitative risk analysis and
- 00:13 our primary tool to do this is the risk matrix.
- 00:16 Most organizations are operating with limited time and resources.
- 00:22 So it's important to minimize the threat risks and maximize opportunity risks.
- 00:26 However, since they are constraints, you can't minimize all threats and
- 00:31 take advantage of all opportunities.
- 00:33 And it's probably no surprise that some risks will have a different impact
- 00:37 than others.
- 00:38 Therefore, you need to prioritize which risks to address.
- 00:41 This prioritization is known as Qualitative risk analysis.
- 00:45 In addition, as industry and organizational conditions change, and
- 00:49 as elements of the project plan need to change,
- 00:51 the risk priority often changes throughout the life of the project.
- 00:55 As a project manager, you decide which risks are critical threats, and
- 00:59 take action to eliminate or prepare for them.
- 01:01 And you identify which opportunities could have the biggest impact on the project and
- 01:05 take advantage of those.
- 01:07 Qualitative risk analysis provides focus on those critical risks.
- 01:12 Qualitative risk analysis normally results in placing risks into
- 01:15 one of three categories that often use to stop like colors to segregate them.
- 01:20 There is the red light.
- 01:21 The red risks are large, critical risks.
- 01:24 They are likely to cost significant disruption and problems or
- 01:27 significant improvement to the project goals.
- 01:30 If it is a negative risk, the risk could doom the project to failure.
- 01:33 These risks are likely to happen and
- 01:35 they we'll prevent the project from achieving all the goals and objectives.
- 01:39 Next are the yellow risks.
- 01:41 These are the cautionary risks.
- 01:43 They are manageable but they require a lot of effort to manage them.
- 01:46 They must be closely monitored, possibly micromanaged.
- 01:50 They do cause some disruption but not to the level of project failure.
- 01:55 Finally, there are the green risks.
- 01:57 These risks are not a significant issue on the project.
- 02:00 Many times a green risks are red or yellow risks that have been mitigated.
- 02:03 They're still an issue and irritant, but because of the mitigation action,
- 02:07 they will not have an significant impact any longer.
- 02:11 The primary technique we use for determining the red, yellow,
- 02:14 green status is the risk matrix.
- 02:17 This is considered a qualitative technique because it is not meant to involve
- 02:21 in-depth testing or analysis.
- 02:23 The tools of matrix and
- 02:25 each risk will be placed in the matrix at the appropriate location.
- 02:29 One side of the matrix is probability.
- 02:31 I assess the probability of a risk by considering how
- 02:35 frequently it has occurred on the last five similar projects.
- 02:38 If it's happened on all or almost all of them, the probability is high.
- 02:42 If it didn't happen on any of them, then the probability is low.
- 02:46 When I look at impact side, I consider the existing project plan or
- 02:50 the intended approach if the plan is not yet finished.
- 02:53 And I consider the project goal or objective.
- 02:56 I ask the question, what if this happens on this project?
- 02:59 Does that impact the goals or objectives of this project, and if so, by how much?
- 03:05 A matrix can be created to analyze the opportunities or threats.
- 03:09 Normally, there is a matrix created for
- 03:11 each, although I have seen a matrix that tried to combined the two.
- 03:15 Personally, I thought it was clunky, and I recommend using two separate matrices.
- 03:19 Finally, the size of the matrix can vary.
- 03:21 I have seen 3 x 3s, 4 x 4s, and 5 x 5s.
- 03:25 Any of these will work, use the one your organization has adopted, or
- 03:29 the one that suits your personal preference.
- 03:31 The last point I wanna make about a qualitative analysis of the risk matrix,
- 03:35 is that it is meant to be a fast and easy approach to filtering risks.
- 03:40 The risk that end up in our red zone we'll normally do a more in-depth analysis with,
- 03:45 but this step should be fast.
- 03:46 That leads us to a comment on the rating scales that are used on the risk matrix.
- 03:52 The most common is to use some type of quantitative scale
- 03:55 even though a risk matrix is a qualitative technique.
- 03:59 This is one that I pulled from one of my clients who uses a 5 x 5 matrix.
- 04:04 The impact scale is usually in money, but
- 04:06 I have occasionally seen it quantified in units of time.
- 04:09 I personally don't like to use the quantitative scale.
- 04:12 I get people arguing whether the impact is
- 04:16 going to be $9,999 or $10,001, if they try to force a risk into a particular color.
- 04:22 If you're using a quantitative scale, try to relate your risk to something that
- 04:26 actually happened on another project in order to quantify your impact.
- 04:30 I prefer to use a qualitative scale such as this analysis,
- 04:34 which is for 3 x 3 matrix.
- 04:36 In this case,
- 04:37 we rely on the subject matter experts to help us assign the correct rating.
- 04:41 One more point about the value of a risk matrix.
- 04:43 I've had projects where stakeholders were upset with the team and
- 04:47 felt that they were being too negative when they presented their risk.
- 04:50 By showing the risk matrix,
- 04:52 the team is able to explain why they think a particular risk is red or yellow.
- 04:57 The matrix forces the stakeholders to consider the probability and
- 05:00 the impact and not just emotion when prioritizing risks.
- 05:04 Risk prioritization is an important role of project management.
- 05:09 The project time and resources are constrained, risks must be
- 05:13 prioritized to make effective use of the scarce project resources.
Lesson notes are only available for subscribers.
PMI, PMP, CAPM and PMBOK are registered marks of the Project Management Institute, Inc.