Qualitative vs quantitative risk analysis: when to use each

What qualitative risk analysis is

Qualitative analysis assesses each risk on its own. You rate probability and impact on a short ordinal scale, usually 1 to 5, multiply or combine them into a score, and place the risk on a probability and impact matrix. The output is a ranked list and a colour (green, amber, red) that tells you where to spend attention.

It is fast, needs no special data, and works in a workshop with sticky notes. Its limits come from the scales: a score of 6 is not "twice as bad" as a score of 3, and two risks with the same score can have very different consequences. It also says nothing about how risks add up across the project.

What quantitative risk analysis is

Quantitative analysis uses numbers with real units: dollars, days, percentages. At the simple end it means expected monetary value for each risk (EMV = probability × impact) and a decision tree for a few choices. At the full end it means a Monte Carlo simulation: you give activities a range of durations or costs, attach risk events, and run the schedule or budget thousands of times. The result is a distribution, read as P50, P80 and P90 values, plus the activities and risks that drive the result.

It answers questions the matrix cannot: what is the chance we finish by the contract date, how much contingency gives us 80% confidence, and which three risks matter most to the finish date.

Worked example: the same three risks, two methods

Assume a probability scale where 1 = under 10%, 2 = 10% to 30%, 3 = 30% to 50%, and an impact scale where 3 = $25,000 to $50,000, 2 = $5,000 to $25,000, 5 = over $100,000.

The matrix ranks R2 last. EMV ranks it first. Both views are useful: R3 is likely and deserves a quick fix, while R2 is rare but large enough that a single occurrence would exceed the total EMV of all three risks. The total of $25,600 is a starting point for contingency, but it is an average; it does not tell you how much reserve gives 80% confidence. That needs a simulation.

Notice also that the qualitative scores depend on where the band edges fall. If R1 had been 30% instead of 25%, it might move from band 2 to band 3 and its score from 6 to 9, while its EMV would change only from $10,000 to $12,000. Scores are good for sorting, but small changes in judgement can produce large jumps.

When to use each

A practical sequence: identify risks, score them qualitatively, then run quantitative analysis on the schedule and cost model using the high-scoring risks plus duration uncertainty. Quantitative analysis needs a sound schedule. A plan with missing logic or hard constraints will produce confident but wrong numbers, so fix the network first.

Moving from scores to numbers, step by step

1. Clean the register. Make sure each risk is written as cause, event and effect, and remove duplicates and issues that have already happened.
2. Pick the risks that matter. Take the high and medium scoring threats and opportunities into the quantitative model. Low scoring risks rarely move the result.
3. Put numbers on each one. Replace the scale band with a probability and a cost or delay range: for example, 25% chance of 10 to 20 extra working days on the design activity.
4. Add estimating uncertainty. Give key activities three-point durations (optimistic, most likely, pessimistic), because ordinary variation often matters as much as discrete risk events.
5. Check the schedule. Every activity needs a predecessor and a successor, and hard constraints should be rare, otherwise the simulation cannot push delays through the network.
6. Run and read the results. Compare the deterministic date with P50 and P80, and look at the drivers list to see which risks deserve stronger responses.
7. Feed decisions back. Set contingency from the gap between the plan and the chosen percentile, update responses, and re-run after major changes.

Common mistakes

• Doing arithmetic on ordinal scores. Adding matrix scores to get a "project risk score" mixes unlike things. Use EMV or simulation for totals.
• Undefined scales. If "likely" means 30% to one person and 70% to another, the matrix is noise. Write the ranges down.
• Treating EMV total as the reserve. It is a mean. Use a simulation percentile if you need a confidence level.
• Simulating a broken schedule. Run schedule quality checks before trusting P80 dates.
• Ignoring opportunities. Both methods should include positive risks.

How to do this in Critova

In Critova you score risks on a clickable 5×5 matrix and record cost and schedule exposure and EMV in the same register. For the quantitative step, the Monte Carlo schedule risk analysis takes triangular or PERT durations and risk events on activities, uses Latin Hypercube sampling with a fixed seed, and reports P50, P80 and P90 dates with criticality and sensitivity. The Monte Carlo and P80 guide explains how to read the results, and the risk score calculator handles quick scores and EMV.