Risk Analysis
From a full register to a ranked, quantified few
Qualitative analysis prioritizes: assess probability and impact using the documented scales, place the risk on the probability-impact matrix, consider data quality, urgency, and manageability, then rank. It is fast, applies to all risks, and drives which risks deserve quantitative treatment. Quantitative analysis applies to the significant few: expected monetary value (EMV), decision tree analysis, sensitivity analysis presented as a tornado diagram, and Monte Carlo simulation.
Know what each output buys you. EMV equals probability times monetary impact and feeds contingency sizing for discrete risks. Decision trees compare alternatives by rolling back EMV through the branches. Sensitivity analysis shows which variable most affects the outcome. Monte Carlo produces a distribution: probability of meeting a date or budget, and a confidence-level contingency figure.
Traps: using qualitative ranking to justify a precise dollar reserve; applying quantitative analysis to every risk regardless of value; ignoring correlation between risks, which understates aggregate exposure; forgetting optimism bias; treating EMV as a prediction rather than a long-run average; forgetting that a risk with low probability but catastrophic impact may outrank a frequent minor one regardless of score.
Rule of thumb: if a risk would not change a decision, do not spend quantitative effort on it.
Worked example: Risk A: 30% chance of a $40,000 rework cost, EMV $12,000. Risk B: 5% chance of a $300,000 penalty, EMV $15,000. Ranked by score, A may look larger; ranked by EMV and consequence, B dominates and gets the response budget.