After you identify project risks, you need to analyze them to see which ones are important enough to manage. The most common form of analysis is called qualitative risk analysis. The risk level is referred to as “qualitative” since it is a quick approximation and does not reflect the rigor of a detailed, numerical analysis. The overall risk level can be as simple high, medium, or low, depending on the severity of impact and the probability of the event occurring.

There are many techniques for performing qualitative risk analysis. Here are two examples.

High, Medium, Low Table

For example, you can use a table like the one below as a starting point. It helps identify high, medium and low level risks by looking at the probability of the occurrence and the overall impact to your project. For instance, a highly likely / high impact event is obviously a high risk. Likewise an event that has a low impact to your project, and has a low likelihood of occurrence anyway, is obviously a low risk. The other combinations fall somewhere within these two extremes.

High, Medium, Low Color Chart

You can also represent these nine simple risk combinations in a table as follows:

Qualitative risk analysis relies on subjectivity to determine whether a risk is worth managing or not. For the vast majority of projects this subjective decision is good enough.