Risk Analysis

As noted in ISO 31000, Risk Analysis involves development of an understanding of the risks. Through risk analysis causes and effects of risks are identified, along with the likelihood of their occurrence. It also provides input into determining whether treatments are required.

Risk analysis is the process of characterising the risks that have been identified using the processes outlined in Risk Identification. It is typically broken into two distinct stages or aspects: Qualitative Risk Analysis and Quantitative Risk Analysis. These stages are sequential because quantitative risk analysis cannot be undertaken without qualitative risk analysis preceding it.

These two aspects of risk analysis are considered in turn.

Collecting Risk Analysis Inputs

Stakeholder Involvement - Getting a Balance of Opinions

Wherever it is necessary to base risk analysis inputs on stakeholder opinions, it is crucial that a broad cross-section of project representatives be involved in order to obtain a balanced perspective of project uncertainty. Ideally, stakeholder involvement in determining project uncertainties should involve:

    • Balanced representation of all parties where potential for conflict of interest exists - In some circumstances, multiple parties may be involved with conflicting vested interests in seeing a more optimistic or pessimistic result from a risk analysis. In such circumstances, it is important that representation is given to all parties involved so as to minimise bias.
    • Representatives of all facets of project delivery – In most complex projects, responsibility for different facets of project delivery is delegated to a range of personnel according to their individual specialisations. In such circumstances, it is important that one or more representatives from each specialisation be included in the risk ranging and identification processes in order to gather the most accurate and informed cross-section of information possible.
    • Both junior and senior project personnel – Junior personnel add value as they’re usually more actively involved in performing the work and may have a more “hands on” feel for current areas of potential uncertainty. Senior personnel bring a wealth of experience and are very useful for identifying areas of concern from past projects. Additionally, senior personnel are usually privy to additional information that may not be available to the more junior representatives that might be pertinent to the eventual risk outcome.

Impartiality & Answerability

Ultimately, in order to obtain a truly accurate outcome from a risk analysis, the process should be as impartial as possible. This is difficult to achieve for most persons working directly within a project team because they’ll usually be answerable to a senior member of the project team with a vested interest in obtaining a result that fits with expectations in order to get the project “over the line”.


Specialist independent risk consultants are not bound by the same constraints and can often bring additional skills to the table that will likely result in a quicker and more accurate analysis than those conducted “in-house”. However, even when using independent consultants, it is desirable that they be engaged and be answerable to the organisation rather than the project team in order to remain truly independent.