Qualitative risk analysis is the process of prioritizing project risks by scoring the probability and impact of each one. You rate every identified risk on an agreed scale, combine the two scores into a risk rank, and sort the list. The result tells you which risks need a response now, which need more analysis, and which you can just watch.
Key takeaways
- Score every risk. Rate probability and impact on a 1 to 10 scale and multiply them to get the risk rank.
- Agree on the scale first. A 7 means nothing until your team and sponsor agree on what a 7 costs.
- Let the matrix decide. Red risks get a response now, yellow risks get more analysis, and green risks go on a watch list.
- Skip quantitative analysis on most projects. Small and medium IT projects don’t need more than a good qualitative analysis.
If I could improve only one thing in my project management, I’d choose this. It raises your chances of project success more than anything else I know.
Why? I honestly believe this analysis is enough for most small and medium projects. If every risk on your list looks equally urgent, you end up putting out fires you could have seen coming. That’s managing chaos, not projects.
The process is simple. It doesn’t require special knowledge, and the effort is modest.
The benefits are worth it:
- You focus on the problems that are crucial for project success.
- Your team shares their concerns and fears instead of hiding them in padded estimates.
- Stakeholders get a reason to engage with the project.
- Everyone sees the threats and opportunities on the project.
I’m going to show you a real example first. Then I’ll walk you through everything behind it (the scales, the matrix, the process, and the outputs), so you can run the same analysis on your own project this week.
Qualitative Risk Analysis Example
Here are five risks from one of my IT projects. You’ll find the same risks in my Risk Register example.
Each risk got a Probability and an Impact score on a 1 to 10 scale. The Risk Rank is Probability × Impact. The zone comes from the Probability and Impact Matrix you’ll see further down.
| Risk | Probability | Impact | Rank | Zone | What happens next |
|---|---|---|---|---|---|
| Mobile developers are limited and in high demand across projects. | 8 | 8 | 64 | Red | Respond now: agree on a cross-project resource plan and secure the developers. |
| The web app depends on designs from an external design team. | 6 | 10 | 60 | Red | Respond now: put weekly reports and on-site meetings into the vendor contract. |
| Only one engineer can deliver a key work package, and they may leave the company. | 6 | 10 | 60 | Red | Respond now: start knowledge transfer and ask HR for a backup. |
| New functionality may require infrastructure changes. | 3 | 10 | 30 | Yellow | Analyze further: ask the infrastructure team and run early performance tests. |
| UI work depends on another deliverable being finished first. | 3 | 7 | 21 | Yellow | Analyze further, add a small reserve, and keep it on the watch list. |
Look at the infrastructure risk. A rank of 30 looks harmless, but the impact is a 10, so the matrix still puts it in the yellow zone. It won’t top your list, and it can still sink the project. That’s why I use the rank to sort and the matrix to decide what to do.
With the list sorted, I know where to spend my time and my risk budget.
Qualitative vs Quantitative Risk Analysis
Qualitative risk analysis scores every identified risk on a relative scale, such as 1 to 10 or Low, Medium, and High. Quantitative risk analysis puts numbers on the risks: money, days, and the odds of hitting your deadline or budget.
You do qualitative analysis for all risks. It’s fast and cheap. Some people call it qualitative risk assessment; it’s the same thing.
You do quantitative analysis only for the top-priority risks, if at all. It takes more data, more time, and often special tools like Monte Carlo simulation or decision trees.
Most small and medium IT projects never need quantitative analysis. A good qualitative analysis gives you enough to act.
Project Risk Management Overview
If you are new to risk management in general, watch this video first.
It gives you an overview of the risk management process and shows where Qualitative Risk Analysis fits in.
Risk Management Definitions We Need to Know
Before we get into the details, we need to clarify a few other definitions.
First of all, what is a risk?
A risk is an uncertain event or condition that, if it happens, affects at least one project objective: scope, schedule, cost, or quality.
If the effect is negative, it’s a Threat.
If the effect is positive, it’s an Opportunity.
A project manager works with both types. You protect the project from threats and take advantage of opportunities.
Here is an example:
You know that one of the key experts on your project is going to leave the company soon.
It’s a threat.
You need to reduce the damage. For example, you can get a replacement in advance to ensure knowledge transfer.
But look for the opportunity, too!
The same event gives you a reason to ask your management for a stronger expert.
That’s why it pays to know which people will be released from other projects soon. You can try to secure them in advance.
Risk Appetite, Risk Tolerance, Risk Threshold
Three terms describe how much risk your stakeholders are ready to accept:
Risk Appetite is a general, subjective description of how much uncertainty stakeholders will accept.
Risk Tolerance is a specific, measurable range of acceptable variation.
Risk Threshold is the point beyond which a risk is no longer acceptable and needs action.
For example, your sponsor says the budget is tight, but there’s no hard deadline.
That means the risk appetite for cost is low, while the schedule can take more risk.
Then they say the project can go over budget by up to $10,000. That’s their risk tolerance for cost.
And they say any single risk that could cost more than $5,000 must come to them with a response plan. That’s the risk threshold.
Get these values directly from your stakeholders. Don’t guess them.
Why do you need them? They help you:
- Choose the right risk management approach.
- Prioritize and escalate the right risks.
- Develop an effective risk response strategy.
Impact and Probability
Let me now put the PMBOK® Guide definition in plain words.
Qualitative risk analysis means grading each risk by its probability and impact on a scale you agreed on in advance.
Based on the grades, you prioritize the risks and develop action plans (Risk Response Plans).
Impact is how strongly the risk will affect the project if it happens. Remember, the effect can be positive or negative.
Probability is how likely the risk is to happen.
Your first job is to define the scales for impact and probability. A simple spreadsheet is enough.
But the scales should:
- Match your project management approach.
- Follow your company’s internal policies and procedures, at least for communication and reporting.
- Mean the same thing to every stakeholder.
Most teams fail on the last point. An impact of 7 tells your sponsor nothing until everyone agrees on how much money or time a 7 costs.
My free AI Prompt Pack has a prompt that builds these scales for you. AI asks you 4 or 5 questions about your project, then writes a 5-point impact and probability scale tied to your budget, schedule, and scope.
You can find examples of impact and probability scales on the Internet, and I’ll share mine below. Use them as a starting point only. Take the time to adapt them to your organization.
Here is an example of an Impact scale:
The Probability scale is even simpler:
Notice the 10. If something is a fact, it’s not a risk anymore. It’s an issue, and you deal with it now instead of analyzing it.
Qualitative Risk Analysis Matrix
This chart goes by several names: Probability and Impact Matrix, Qualitative Risk Analysis Matrix, or just Risk Matrix.
They all mean this:
Using your impact and probability scales, plus your stakeholders’ risk appetite, tolerance, and threshold, mark the cells:
Red: risks that need a response.
Yellow: risks that need more analysis and investigation.
Green: risks you can accept and leave for now.
The blue cells are the facts from the probability scale: high-impact events that are already certain. Treat them as issues and act now.
How to Perform Qualitative Risk Analysis
Now, let’s put it all together. The process has four steps:
- Put all identified risks into the Risk Register. I suggest you run the risk identification process separately, before the analysis.
- Score each risk on your impact and probability scales. Write the scores into the Risk Register.
- Calculate the rank, sort the list, and place each risk on the matrix.
- Turn the sorted list into the outputs described below.
When does this happen?
You can run the analysis at any moment, with any number of known risks. On real projects, I do it at these points:
During project initiation. A high-level analysis of known risks to check whether the project is feasible.
During planning. One or several sessions where most of the analysis happens. You go through the long list of identified risks in detail as part of your project planning.
It may cover separate deliverables or the project plan as a whole.
During execution. After kickoff, things will change. Analyze how each change affects your risks, and reassess known risks on a regular schedule.
Who should be involved?
You. You are the key expert on project management risks. Even so, I’d recommend checking your scores with your peers.
Individual stakeholders. Some specific risks are faster to analyze one on one.
Expert groups. Most of the time, you’ll work with a small group of people who know the subject best.
The whole project team. If the team is small enough, involve everyone, at least to collect more points of view.
As you can see, most of this happens in interviews, meetings, and brainstorming sessions. So keep the rules of productive meetings in mind.
The Outputs of Qualitative Risk Analysis
What should you have at the end? These are the main outputs, and they all go into your Risk Register:
- A prioritized list of risks. Your Risk Register should make it obvious which risks you’ll deal with first.
- Risks grouped by category. Grouping shows you the root causes behind several risks. Sometimes one response covers a whole group, or you can remove the cause itself.
- Risks that need more analysis. Sometimes you won’t have the expertise at hand to score a risk correctly. Mark it and get a consultation.
- Urgent risks. Some serious risks need action now. Otherwise, they can hurt the project before it even starts.
- A watch list. Low-priority risks you keep an eye on. They don’t need a response now, but they might cause problems later.
As you can see, qualitative risk analysis is simple. Still, it focuses you on the risks that matter, and it removes guesswork from planning, because you put time and money where the real threats and opportunities are.
Qualitative Risk Analysis Template: Why the Scale Matters More Than the File
If you came here for a template, I get it. You want something you can fill in today.
A template helps, but you’ve already seen everything it would contain: a Probability column, an Impact column, a Rank, and a matrix. You can set that up in a spreadsheet in ten minutes.
The hard part is the scale. What does a 7 mean on your project? If your team can’t answer that the same way, every score in the file is a guess, and the analysis falls apart at the first status meeting.
When I got my PMP, I tried to bring textbook risk management to a company that had none. Nobody followed it, and I was back to managing chaos. What worked was just enough process to stay in control, light enough that the team actually follows it. Your team will use a short scale they understand. They won’t open a perfect template.
And today, AI drafts that scale better than any template, as long as you give it your project’s context. Ask ChatGPT for “a risk impact scale” without context, and you’ll get a generic High/Medium/Low table that fits nobody’s project.
I put together a free AI Prompt Pack for project managers to solve that: 27 copy-paste prompts for real IT project work. Two of them fit this article:
- Impact and Probability Grades Descriptor. AI asks you 4 or 5 questions about your methodology, constraints, budget, and risk appetite. Then it builds a 5-point rubric for your project: percentage ranges for probability, and measurable impact thresholds for cost, schedule, and scope/quality.
- Project Context File Builder. You build one file with your project goal, stakeholders, scope, team, timeline, budget, and known risks. Attach it to every prompt, and AI answers about your project instead of a generic one.
Get the free AI Prompt Pack and run the Grades Descriptor on the project you’re managing now. You’ll walk into your next risk session with impact and probability scales your team already agrees on.
Qualitative Risk Analysis FAQ
What is an example of qualitative risk analysis?
Say an external design team may deliver late. You score the probability as 6 and the impact as 10, so the risk rank is 60 and the risk lands in the red zone, where you plan a response now. You’ll find five real risks scored this way in the example table above.
Is qualitative risk assessment the same as qualitative risk analysis?
Yes, for project work. Many people say “assessment” and mean the same thing: scoring each risk’s probability and impact and ranking the list. The PMBOK® Guide calls the process Perform Qualitative Risk Analysis.
What is the difference between qualitative and quantitative risk analysis?
Qualitative analysis ranks all risks on a relative scale. Quantitative analysis puts numbers on the top-priority risks: a 30% chance of a $20,000 loss gives an expected monetary value of $6,000. You do the qualitative part on every project and the quantitative part only when the stakes justify the effort.
What tools and techniques do you use in qualitative risk analysis?
The PMBOK® Guide lists expert judgment, interviews, facilitation, meetings, risk categorization, a risk data quality assessment, and the probability and impact assessment itself. The main output is shown in a probability and impact matrix. In practice, you need agreed scales, a Risk Register, and the right people in the room.
What is a qualitative risk matrix?
It’s a grid with probability on one axis and impact on the other. Each cell is colored red, yellow, or green based on your stakeholders’ risk thresholds. You place every risk on the grid to see which ones need a response, which need more analysis, and which you can accept.
What is qualitative risk analysis in PMP?
In the PMBOK® Guide, Perform Qualitative Risk Analysis is the process of prioritizing individual project risks for further analysis or action by assessing their probability of occurrence and impact, plus other characteristics. It comes after Identify Risks and before Perform Quantitative Risk Analysis and Plan Risk Responses. Its main output is an updated Risk Register.
Conclusion on Qualitative Risk Analysis
Qualitative risk analysis is the simplest step in risk management, and it pays off the most. Score every risk for probability and impact, sort the list, and act on the red zone first. The next time your sponsor asks which risks matter, you’ll answer with one sorted list.
It’s still one piece of a bigger risk management process. You identify risks before it, and you plan responses and monitor risks after it. When one step is missing, the others don’t hold up.
Get it right, and your project runs on a system, not on overtime. That’s how you stop managing chaos and start managing projects.
You’ll find the rest of my articles on this topic on the Risk Management page.
Before your next risk session, grab the free AI Prompt Pack and build your impact and probability scales first.