Qualitative Risk Analysis Tools on the PMP Certification Exam
The primary technique for analyzing and prioritizing risks that you should know about for the PMP Certification Exam is a PxI analysis that is later charted on a PxI matrix.
To conduct a PxI assessment, you start with the risk statement in the risk register. You might interview the team member with the most information about the risk or do some research to understand the risk.
For complex and technical projects, you might call in a subject matter expert or conduct a risk workshop or survey. The outcome is rating the likelihood (probability) of the event occurring as well as the impact if the event occurs. This information is entered into the risk register and the PxI matrix.
Look at how this process would be applied using the three risks identified for the childcare center example:
For this example, the date is July 6; assume the following information:
Because the cost to install security cameras in the childcare center is greater than anticipated, there is a risk we will overrun the budget.
Ten cameras are planned for installation around the childcare center and the playground. Each camera is estimated to cost $250. However, the camera model that was estimated is no longer available, and the new model costs $310 each. Reducing the number of cameras, though, will compromise the security and is thus an unacceptable trade-off.
The city may not approve the plans, thus causing a schedule delay.
You interviewed the contractor, who stated that of the last ten childcare centers he built, the city sent back plans on four. The time to resubmit and get approval ranged from 14–35 days. You submitted your plans on June 30. The city has a 30-day time frame to get back to you.
A team member may be reassigned to a higher priority project, thus causing a schedule delay.
You heard that your team member in charge of security might be pulled off the project and replaced by someone who is new to the company and without the same experience level. You don’t have confirmation, though.
The score is determined by multiplying the probability times the impact. If multiple objectives are impacted, you add the scores. For example, if you look at the risk of the city not approving the plans, you multiply
(2 x 3) + (2 x 3) = 12
Include a section for comments on your risk register.
At this point, responses are set for some cases (such as fast-tracking the schedule and working overtime), but the responses aren’t formally outlined. When planning responses, you might apply multiple responses, or you might use a response that impacts multiple risks. At this point, you’re only analyzing the risks.
The PxI matrix is for the schedule objective. It demonstrates how risks would be plotted if you were looking only at schedule impacts. You would have one of these for all objectives.
If you’re not rating each objective individually, you would obviously have just one matrix that combines impact scores.
The PxI matrix you see here is called a 5 x 5 (5 by 5) because it rates risks in five grades of probability and five grades of impact. You can use whatever configuration you want. Most people use an odd number, but beware of too many risks congregating in the middle cell. Try to keep the middle cell empty so you can have a more definitive rating.
When assessing risks, take into consideration the urgency of the situation. Given that the date is July 6, the plans have been submitted to the city for approval, and the approval is due in three weeks, that is your most urgent risk. Even if it didn’t have the highest score, you might consider moving this up your list for responses based on the near time frame.
Another technique to apply is determining the data quality. This means that you can perform a good risk assessment only if you have quality data. In other words, Garbage In, Garbage Out.
After analyzing the risks, you may find that you have groups or categories of risks, such as technical risks, requirements risks, schedule risks, and so on. Categorizing risks can help you later when developing responses because you can develop one response that will be effective for several risks.