Configuring Risk Matrix for Quantitative Risk Analysis

General discussion and questions about project risk management and risk analysis software RiskyProject. Includes discussion on how to perform efficient project risk analysis using our software.

Moderator: Intaver Support

Post Reply
Hato
Posts: 20
Joined: Tue Jun 01, 2010 5:34 am
Location: US
Contact:

Configuring Risk Matrix for Quantitative Risk Analysis

Post by Hato » Tue May 04, 2021 9:03 pm

I am confused by the idea that the risk impact 'Duration' has a percentage value in the 'Format Risk Matrix'. In my experience the only 'probability classes' are expressed in percentages, the duration classes in time (i.e. days) and the cost impact in money.
It is only when I use the 'Drag 'n Drop Risk' menu that I get the option to classify the Duration impact in days, instead of percentage or class. However, when I open the Risk afterwards, I cannot edit or see these values anymore. Is it possible to define the Duration impact classes in days? i.e. class 1 = 0-3 days ; class 2 = 3-15 days ; and so on.
Project manager

Intaver Support
Posts: 992
Joined: Wed Nov 09, 2005 9:55 am

Re: Configuring Risk Matrix for Quantitative Risk Analysis

Post by Intaver Support » Tue May 04, 2021 9:10 pm

The reason for this for qualitative risk analysis standard 5 x 5 risk matrix works well as you are only "placing" the risk onto the matrix using a simple probability x impact with subjective scores (1,2,3,4,5) or labels (very low, low,.. etc), From this you get a simple score e.g 3*5= 15 and the risk is placed in the middle of corresponding cell on the matrix.

However, with quantitative analysis, this risk matrix configuration fails to capture true levels of risk (and is a well known shortcoming of the methodology). Why is this, well for the qualitative configuration, each row or column has no objective values. But for quantitative analysis, without modification they each represent an equal portion of the possible ranges of probability and impacts (0-100%). If we do not modify the ranges, the risk matrix does not provide a valid ranking of risks.

Lets look at a simple example of the same risk both qualitative and quantitative assessment.

Project 500 days The risk has a 40% probability (high) and 100 day impact Medium
1. Probability High (4) x Schedule Medium (3) - 4 x 3 = 12 So not critical, but would considered worth managing.

Image

Now if we run the same analysis quantitatively the risk lands here. It is now located in the Green squares which normally would put it on the watch list.

Image

So well the risk is not critical, the rating the Matrix provides does not communicate its impact well. It is the major issue with using a standard Risk Matrix with quantitative analysis. In most cases, the risk severity scores will not be represented accurately.
The solution is to adjust the ranges for both probability and impact so they align with how you want to assess risk severity,
Here is an example. In this case, we have 4 severity ratings I have adjusted ranges so they more accurately reflect how the team views risk impacts and probabilities and is proportionally in line with quantitative analysis.

Image
Intaver Support Team
Intaver Institute Inc.
Home of Project Risk Management and Project Risk Analysis software RiskyProject
www.intaver.com

Post Reply