Certopolis

Certified Associate in Project Management (CAPM)

Risk analysis vs risk evaluation and how to write a risk

Risk analysis sets the level of a risk from how likely it is and what its consequences would be. Risk evaluation then compares that level with the organization's risk appetite to decide where and what further action is needed. Both depend on the risk being written properly, as cause, event and consequence.

Writing a risk

The UK Orange Book defines risk as the effect of uncertainty on objectives. A risk is usually expressed in terms of its causes, a potential event, and the consequences if the event happens.

It warns against two mistakes. One is stating a consequence as the risk itself, which records a symptom without its cause. 'Service failure' and 'increased costs' are consequences in the Orange Book's own examples. The other is writing a risk as the converse of an objective, such as 'failure to deliver the new system'.

Risk analysis

Risk analysis uses a common set of risk criteria so that risks are rated consistently. It defines the level of risk from the likelihood of the risk occurring and the consequences should the event happen.

When a consequence rating is assigned, the Orange Book says to use the rating for the highest, most credible worst-case scenario. Analysis can be qualitative, quantitative or both, and should also consider confidence in the information, how risks connect, timing and how well existing controls work.

Risk evaluation

Risk evaluation compares the results of the analysis with the nature and extent of risk the organization is willing to take, its risk appetite, to decide where and what additional action is required.

The outcome should be recorded, communicated and validated at appropriate levels of the organization. It should be regularly reviewed and revised, because risks change. Risks should be identified whether or not their sources are under the organization's direct control.

Where the exam catches people

  • Believing 'increased costs' is a well-written risk: it is a consequence; the risk needs its cause and event.
  • Believing risk analysis decides what action to take: analysis sets the level of risk; evaluation compares it with risk appetite to decide on action.
  • Believing the consequence rating should use the average outcome: the Orange Book uses the highest, most credible worst-case scenario.
  • Believing only risks the project controls belong in the register: risks are identified whether or not their sources are under the organization's control.
  • Believing an evaluation result is fixed once recorded: it should be validated and regularly reviewed and revised.

Written from PMI's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A team has rated each identified risk by likelihood and consequence. It now compares those results with the nature and extent of risk its organization is willing to take, to decide where further action is needed. Which technique is used for this comparison?

    Right. In the game that’s Renown for your Project Management Fundamentals and Core Concepts building.

    Not that one: D is right. In the game your Project Management Fundamentals and Core Concepts building would lose a little Renown, and this question would come back later.

    Written from www.gov.uk/government/publications/orange-book/the-orange-book-management-of-risk-principles-and-concepts

  2. A project's draft risk list contains entries such as 'Service failure', 'Increased costs' and 'Failure to deliver the new system'. A reviewer says these record symptoms and restated objectives rather than risks. Which technique is used to rewrite each entry?

    Right. In the game that’s Renown for your Project Management Fundamentals and Core Concepts building.

    Not that one: B is right. In the game your Project Management Fundamentals and Core Concepts building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Rewriting each entry as cause, event and consequence fixes both faults.

    Written from www.gov.uk/government/publications/orange-book/the-orange-book-management-of-risk-principles-and-concepts

  3. A project team is analysing a newly identified supplier-failure risk. For its possible outcomes, the team uses the highest, most credible worst-case scenario. Which two of the following will define the level of the risk? (Choose two)

    Right. In the game that’s Renown for your Project Management Fundamentals and Core Concepts building.

    Not that one: A,E is right. In the game your Project Management Fundamentals and Core Concepts building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    When the consequence rating is assigned, the rating for the highest, most credible worst-case scenario is used.

    Written from www.gov.uk/government/publications/orange-book/the-orange-book-management-of-risk-principles-and-concepts