Qualitative

versus Quantitative Risk Analysis

Which is Better?

Both Qualitative and Quantitative risk assessments are effective when used for the
appropriate applications. Quantitative risk analysis is focused on the “quantity” of an
object, event, or action. Quantitative risk analysis typically uses numerical data to analyze
combined risks and uncertainty on a project. Qualitative risk analysis, on the other hand, is
focused on the “quality” of that object, event, or action. Qualitative risk analysis is a quicker
way of the two to establishing risk priorities.

Qualitative Risk Analysis Quantitative Risk Analysis
Typically, is completed prior to Excellent method to add more
Quantitative risk analysis specificity after Qualitative risk
analysis if required
Can assess individual risks Can be used to evaluate
combined effects of risk and
provide an overall project risk
assessment
Easy to implement across Used on larger projects
multiple areas of a business
Quick; information is more Time consuming; more detailed
subjective used to evaluate information required to be
individual risks effective
Risk levels can be in text (Low, Risk values are quantitative and
Medium, High), color coded, has analyze the population with
numerical (1-5) or a some sampling methodology
combination

Regardless of the risk analysis (system) established and implemented, it is important that
Senior Management assure that the process:

1. Identifies hazards and/or situations associated with that activity or event
2. Evaluates an associated risks
3. Controls risks
4. Monitors the effectiveness of actions taken to effectively manage the risk.

1
Senior Management also needs to provide adequate resources and assign appropriate
personnel. They also need to review the risk management process at planned intervals to
access effectiveness of actions taken. Without a focus by Senior Management, any risk
management process will not add value to risk reduction over the product/process life
cycle.

Qualitative Risk Analysis Details

Qualitative risk analysis tends to be subjective. It identifies risks based on
likelihood/probability of an event happening and its impact/severity it will have. Many
organizations use risk registers to document risks. Many matrices are 5x5, but some
organization have opted for 4x4 or even 3x3 (See examples).

Risk is the combination probability of occurrence of harm and the severity of that harm. It
allows an organization to determine which risks are to be eliminated, mitigated, assumed,
avoided, or shared with a customer or supplier.

Risk Matrix Example (5x5) (3x3)

Tip #1 Most organizations use multi-functional teams to construct a risk matrix. In some
situations, organizations use risk registers for all value-added processes in the product
value stream. It is important that all employees agree on ranges of severity and probability
at each level

A risk register is similar to a risk matrix but has additional features, it allows the
organization to document what actions will be taken after the risk has been initially
assessed. After the completion of any actions items the risk is reassessed to determine
effectiveness.

2

Risk Register Example

Tip #2 This tool, risk register, is a convenient and simple tool that can be used at the
organization’s Management Reviews focusing on the risks that have a
higher likelihood of occurrence as well as its impact or severity.

Tip #3. Most organizations use financial risks in qualitative risk analysis. Consider other
risks such as customer satisfaction, business interruption, employee morale or safety. The
reason is that financial metrics, while important, are lagging indicators and the result of
another risk category. Some organizations have used reputation as a risk category.

Quantitative Risk Analysis Details

Quantitative risk analysis relies on verifiable data to analyze the effects of risk in terms of
costs, project scope, resource usage or project schedule delays. It is process for assigning a
numerical value to the probability of an overall loss based on known risks and available
quantifiable data. It does provide objective information than qualitative risk analysis.

It is important to identify when to perform quantitative risk analysis. Step 1 is usually to do
allow both qualitative and quantitative risk assessments. Consider the quantitative risk
analysis if:

• Risks to either/both project budget and schedule demand a contingency plan
• Large projects that require key decisions at multiple program times to continue
• Projects when management demands more details about probability finishing a
project on time and within budget

Tip #4. Employees who manage the quantitative risk management process are competent
based on education, training, skills and experience in Project management. Risk

3
management tasks can be performed by representatives of several functions, each
contributing their specialist knowledge.

Numerous quantitative risk analysis tools and techniques are available. A few are:

• Three Point Estimate – a technique that uses the optimistic (O), most likely (M),
and pessimistic (P) values to determine the best estimate.
Example - Best Estimate = (O + 4M + P)/6
• Monte Carlo Analysis – a technique that uses optimistic, most likely, and
pessimistic estimates to determine the total project cost and project completion
dates.

• Expected Monetary Value (EMV) – a method used to establish the contingency
reserves for a project budget and schedule
Risk Probability Cost Impact EMW
Event based on 25% $200,000 $50,000
Potential Hazard Team Estimate Team Estimate Contingency
based on data based on data Reserve

• Sensitivity Analysis – a technique used to determine which risks have the greatest
impact on a project.

Tip #5. Update risk matrices with the quantitative risk analysis data to maintain a
current record of risk levels

Which is Better?

Both qualitative and quantitative risk analyzes are valuable tools that organizations can use
to assess the probability and severity to processes and projects. The key is to recognize
when to use either one. Qualitative risk analysis is effective in classifying probability and
prioritizing risk in most situations. It is simple and can be understood by employees in
different functions. Quantitative risk analysis is a better method to understand how risk
and uncertainty can affect a project. It is more accurate but more complex than qualitative
risk analysis. The result is a more robust assessment. Quantitative risk analysis is a better
tool for high-risk industries.

References:
• “ISO 9001:2015 Risk Based Thinking”, Bob Deysher, Quality Support Group, May
2020
• “How do you Audit “Thinking” in Risk Based Thinking”, Bob Deysher, 2019 ASQ
Audit Division Conference
• “Is Risk-Based Thinking “Built” into your QMS/BMS?”, ASQ – Merrimack Valley,
December 2017
• “Evaluating Risks Using Quantitative Risk Analysis”, Project Risk Coach.

4
 • “What’s the Difference Between Qualitative and Quantitative Risk Analysis?”, Safran
Software Solutions, 2021