Business Environment · Topic 5 of 8
Risk Identification and Analysis
Plan risk management, identify risks, score them by probability and impact, and apply quantitative tools such as EMV, decision trees and Monte Carlo.
- 5 min
- A risk can be a threat or an opportunity.
- Risk appetite is willingness to take risk, tolerance is how much risk can be withstood, and threshold is the limit of acceptable variation.
- Identify risks repeatedly with brainstorming, checklists, SWOT, interviews and assumption analysis.
What it is
A risk is an uncertain event or condition that, if it happens, affects one or more project objectives. The effect can be negative (a threat) or positive (an opportunity). Risk management plans for both, so the project can avoid surprises and make use of good fortune.
This page covers planning, identification and analysis. The next page covers responses and monitoring.
How it works
Planning risk management
The risk management plan sets out methods, roles, funding, timing, categories, definitions of probability and impact, and reporting formats. It also reflects the organization's risk appetite (how much risk it is willing to pursue), risk tolerance (how much risk it can withstand) and risk threshold (the limit of acceptable variation around an objective, beyond which a risk needs attention).
A risk breakdown structure (RBS) groups risk sources in categories such as technical, external, organizational and project management.
Identifying risks
Risks are found through brainstorming, interviews, checklists, assumption analysis, SWOT (strengths, weaknesses, opportunities and threats) analysis, cause and effect diagrams, documentation reviews and expert input. Identification is repeated throughout the project, because new risks emerge.
Each risk goes into the risk register with a description, cause, potential effect and owner. A good statement follows the shape "because of a cause, an event may occur, leading to an effect".
Qualitative analysis
Qualitative analysis ranks risks quickly using judgment. Probability and impact are rated, such as low, medium and high, or on numeric scales, and combined in a probability and impact matrix to give a priority. The grid below is one example, because each organization defines its own scale.
| Probability | Low impact | Medium impact | High impact |
|---|---|---|---|
| High | Medium priority | High priority | High priority |
| Medium | Low priority | Medium priority | High priority |
| Low | Low priority | Low priority | Medium priority |
Other considerations include urgency (how soon action is needed), proximity (when the risk could occur), detectability and data quality. The result tells you which risks deserve numeric analysis or a response first.
Quantitative analysis
Quantitative analysis puts numbers on the combined effect of risks, usually for the most important ones. Main tools are:
| Tool | What it does |
|---|---|
| Expected monetary value (EMV) | Probability multiplied by impact in money |
| Decision tree | Compares options by the EMV of each branch |
| Monte Carlo simulation | Runs many random trials to show a range of outcomes and likelihoods |
| Sensitivity analysis | Shows which uncertain item most affects the result, often as a tornado diagram |
For EMV, a threat with 30 percent probability and a 50,000 cost impact has EMV = 0.30 x -50,000 = -15,000. An opportunity with 20 percent probability and a 40,000 gain has EMV = +8,000. The EMV of a set of independent risks is the sum of the individual values.
Reserves
The results guide reserves. The contingency reserve is sized to cover identified risks, and the management reserve covers unidentified ones. Reserve analysis tracks how much has been used compared with the remaining risk.
Risk in agile and hybrid projects
Agile teams manage risk in short cycles. The backlog is ordered with risk in mind, so risky items come early to learn quickly. Spikes explore unknowns.
Frequent demos expose problems, and retrospectives discuss risks. Teams may keep a simple visible risk list.
A hybrid project can maintain a formal risk register at project level while teams handle risk in each sprint.
Involving stakeholders
Stakeholders see risk differently, depending on their tolerance. Discuss their views openly, and record agreed thresholds so that responses match their appetite.
Use qualitative analysis first and apply quantitative analysis only to risks that are large enough to justify the effort.
What to remember for the exam
- A risk can be a threat or an opportunity.
- Risk appetite is willingness to take risk, tolerance is how much risk can be withstood, and threshold is the limit of acceptable variation.
- Identify risks repeatedly with brainstorming, checklists, SWOT, interviews and assumption analysis.
- The risk register records each risk, its cause, effect and owner.
- Qualitative analysis ranks risks by probability and impact.
- EMV = probability x impact, and threats are negative while opportunities are positive.
- Decision trees compare options using EMV.
- Monte Carlo simulation produces a range of outcomes with likelihoods.
- Sensitivity analysis shows which variable matters most.
Common mistakes
Treating risk as only negative. Opportunities deserve the same attention.
Confusing EMV signs. Threats have negative values and opportunities have positive values.
Running quantitative analysis on every risk. It is costly, so use it for the major ones.
Identifying risks only once. New risks appear as the project moves forward.
Listing causes as risks. A risk is an uncertain event with an effect, not a certain condition.
Do not mix up risks and issues. A risk register entry should still be uncertain, while a problem that is already happening belongs in the issue log.
Check yourself
Calculate the EMV of a risk with 40 percent probability and a 25,000 cost impact.
EMV = 0.40 x -25,000 = -10,000.
What does Monte Carlo simulation produce?
A distribution of possible outcomes, such as completion dates or costs, with the likelihood of each.
What is the difference between risk appetite and risk threshold?
Appetite is how much risk the organization is willing to pursue, and the threshold is the limit of acceptable variation around an objective.
Topic 5 of 8 in Business Environment
Test yourself on Business Environment
The full PMI PMP question bank has 1,463 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by PMI. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.