Question

1) What is risk and why should should it be a fundamental part of the consideration of a project manager?

2) When would you use a quantitative approach and when would you use a qualitative approach to risk assessment ?

Answer 1

1. Risk takes on many forms but is broadly categorized as the chance an outcome or investment's actual return will differ from the expected outcome or return. Risk includes the possibility of losing some or all of the original investment.

In the financial world, risk management is the process of identification, analysis and acceptance or mitigation of uncertainty in investment decisions. Essentially, risk management occurs when an investor or fund manager analyzes and attempts to quantify the potential for losses in an investment and then takes the appropriate action (or inaction) given his investment objectives and risk tolerance.

Inadequate risk management can result in severe consequences for companies, individuals, and for the economy. For example, the subprime mortgage meltdown in 2007 that helped trigger the Great Recession stemmed from poor risk-management decisions, such as lenders who extended mortgages to individuals with poor credit, investment firms who bought, packaged, and resold these mortgages, and funds that invested excessively in the repackaged, but still risky, mortgage-backed securities (MBS).

2. Once you have identified the risks that could affect your project, you need to determine which ones you will spend time and money on.

Risk analysis is the process of prioritizing risks based on the probability of the risk occurring and the impact it would have on the project.

There are two primary methods of risk analysis you can use on your project...

• Qualitative Risk Analysis
• Quantitative Risk Analysis

The main difference between these two methods of risk analysis is that qualitative risk analysis uses a relative or descriptive scale to measure the probability of occurrence whereas quantitative risk analysis uses a numerical scale.

For example, a qualitative analysis would use a scale of "Low, Medium, High" to indicate the likelihood of a risk event occurring.

A quantitative analysis will determine the probability of each risk event occurring. For example, Risk #1 has an 80% chance of occurring, Risk #2 has a 27% chance of occurring, and so on.

Quantitative risk assessment focuses on factual and measurable data, and highly mathematical and computational bases, to calculate probability and impact values, normally expressing risk values in monetary terms, which makes its results useful outside the context of the assessment (loss of money is understandable for any business unit). To reach a monetary result, quantitative risk assessment often makes use of these concepts:

SLE (Single Loss Expectancy): money expected to be lost if the incident occurs one time.

ARO (Annual Rate of Occurrence): how many times in a one-year interval the incident is expected to occur.

ALE (Annual Loss Expectancy): money expected to be lost in one year considering SLE and ARO (ALE = SLE * ARO). For quantitative risk assessment, this is the risk value.