HKSM

A structured evaluation of identified risks to prioritize them and, when appropriate, quantify their potential effect on project objectives to support decision-making and response planning.

Purpose & When to Use

• Clarify which risks matter most so the team focuses effort where it pays off.
• Qualitatively rank risks by likelihood and impact soon after identification and then periodically.
• Quantitatively model key risks when decisions require numbers, such as setting reserves, selecting options, or forecasting risk-adjusted dates and costs.
• Use when risk exposure may affect scope, schedule, cost, quality, or value, or when stakeholders request confidence levels (for example, P-80 finish date).
• Apply iteratively; update after major changes, new information, or at agreed review points.

Mini Flow (How It’s Done)

• Prepare: confirm risk approach, scales, and thresholds; align on definitions of probability, impact, and other attributes; ensure the risk register and categories are current.
• Qualitative analysis: evaluate each identified risk for probability and impact; consider urgency, proximity, detectability, and manageability; use a risk matrix to prioritize; assign or confirm risk owners; note data quality and information gaps.
• Decide on deeper analysis: if top risks or overall exposure could drive major decisions, schedule, or budget, proceed to quantitative analysis; otherwise move to response planning.
• Quantitative analysis (selected risks or overall exposure): define model scope (cost, schedule, or both); choose distributions for key uncertainties; include dependencies and correlations as needed; run simulations or decision trees; review S-curves, percentiles, and sensitivity (drivers) to see what matters most.
• Record and communicate results: update the risk register and risk report; recommend contingency and management reserves; propose response strategies; update assumptions, forecasts, and any required change requests.

Quality & Acceptance Checklist

• Risk register includes clear cause–risk–effect statements, owners, attributes, and current status.
• Scoring criteria and scales are documented and applied consistently across the team.
• Prioritization is traceable, with rationale and a data quality or confidence rating.
• For quantitative work, model assumptions, inputs, distributions, and correlations are documented and reviewed.
• Outputs include prioritized risk list, key drivers, recommended responses, and reserve suggestions linked to confidence levels.
• Impacts to plans, forecasts, and baselines are evaluated and updates proposed where appropriate.
• Stakeholders have reviewed results, and required approvals or acknowledgments are captured.

Common Mistakes & Exam Traps

• Skipping qualitative screening and jumping straight into detailed modeling.
• Treating issues as risks or assigning probability to events that have already happened.
• Ignoring opportunities and focusing only on threats.
• Using ordinal scores (for example, 1–5) as if they were monetary values in calculations.
• Forgetting to consider overall project risk versus individual risks.
• Not reflecting correlations or dependencies, leading to unrealistic simulations.
• Failing to update the risk register, assumptions, and lessons learned after analysis.
• Assuming quantitative analysis is mandatory on every project regardless of need or data quality.
• Leaving results on paper without linking them to reserves, targets, or response actions.

PMP Example Question

Your team identified more than 150 risks during a workshop. Sponsors want to know which ones deserve attention next week. What should the project manager do first?

1. Perform quantitative risk analysis on all identified risks to compute total contingency.
2. Start implementing responses for the highest-cost risks based on expert opinion.
3. Conduct qualitative risk analysis to prioritize the risks and assign owners.
4. Update the cost baseline with a flat contingency percentage across all work.

Correct Answer: C — Conduct qualitative risk analysis to prioritize the risks and assign owners.

Explanation: After identification, prioritize with qualitative analysis to focus effort. Quantitative analysis or baseline changes come later and only for selected, high-priority risks.