How to Perform Quantitative Risk Analysis

General Process

Once risks are identified and have been screened via qualitative analysis, they can be analysed quantitatively. Recall that identification includes a thorough description of the risk and risk triggers. With quantitative analysis, the probability of occurrence and consequence if the risk event occurs must also be documented. Exhibit 4-3 depicts the workshop process.

Tools and Techniques

1. Gather and Represent Data

· Quantitative analysis is generally led by a cost risk expert from the Strategic Analysis and Estimating Office, sometimes augmented by consultant staff and in collaboration with the Project Manager.

· Interviews: Can be formal or informal settings, such as smaller group meetings or larger formal workshops.

· Subject matter expert input: Participate collaboratively with the project team and cost-risk team; you can also participate in interviews or contribute opinions in other ways such as surveys (questionnaires).

· Data: Represent data in terms of probability and impact; you can represent impacts using discrete distributions or continuous distributions.

2. Quantitative Risk Analysis and Modelling

· Project simulation: Use the Monte Carlo technique to generate a probability distribution of project cost and schedule based on uncertainty and risk effects.

Quantitative Risk Analysis Outputs

1. Risk Register

The risk register begins during risk identification and is further developed during analysis (qualitative and/or quantitative). The risk register is a key component of the Project Management Plan, and includes the following:

· Prioritized list of quantified risks: Those risks that have the most significant impact (threats or opportunities) to project objectives (tornado diagrams, expected values, decision trees).

· Probabilistic analysis of the project: Estimated cost and completion dates and associated confidence levels.

· Quantitative analyses: Can be conducted several times throughout project development; trends can be identified, and mitigation strategies can be implemented and monitored. The risk profile of a project evolves and changes as the project is developed, knowledge is gained, and design changes occur.

2. Informal Workshop (Meeting)

For smaller projects, it may suffice to have an informal workshop composed of the project team and/or key project team members and other participants (such as specialty groups involved with critical items).

Risk management is ongoing and iterative; periodically, workshop members can regroup to evaluate the project and associated uncertainty and risks. Workshops typically occur for a project every 12 to 24 months or at key project milestones. Project risks and mitigation efforts should be discussed at regular project meetings, to make changes as appropriate and, following those changes, re-run the risk model. Value is gained when action is taken to respond to risks, resulting in cost and schedule savings to the project.