Qualitative Risk Analysis and the Risk Rating Matrix
By Joseph Phillips
Once you’ve identified your risks, it’s time for qualitative risk analysis. Qualitative risk analysis qualifies the risks for in-depth analysis. Basically, you and the project team discuss the identified risks, the probabilities of those risks occurring, and their impact if the risks actually do occur.
The most common approach to this process is to create a risk rating matrix. Here’s a quick sample of a risk rating matrix using an ordinal scale:
| Risk | Impact | Probability | Score |
| Vendor | Very high | Medium | High |
| Developer skills | High | Medium | High |
| Firmware changes | Medium | Very low | Low |
| Asteroid | High | Very low | Low |
| Travel delays | Low | High | Medium |
Within your project, you have to determine which of these risks deserve additional analysis. Typically you’d say the risks with a medium score or higher should be taken seriously and are promoted to quantitative risk analysis.
