11.- TOOLS AND TECHNIQUES FOR QUALITATIVE RISK ANALYSIS.
Qualitative assessments are the most basic form of risk assessment, categorizing potential risks based on either nominal or ordinal scales. More rigorous quantitative techniques can be used for assessing risk as more data becomes available through tracking of internal and external events. Such data enables greater analysis of potential risk exposures, development of relevant indicators that can be tracked regularly, and more rapid and efficient responses to risk situations.
Risk rating scales may be defined in quantitative and / or qualitative terms. Quantitative rating scales bring a greater degree of precision and measurability to the risk assessment process. However, qualitative terms need to be used when risks do not lend themselves to quantification, when credible data is not available, or when obtaining and analyzing data is not cost - effective.
Rating scales are not one - size - fits - all and should be defined as appropriate to enable a meaningful evaluation and prioritization of the risks identified and facilitate dialog to determine how to allocate resources within the organization. If risk scales are not standardized in your company, you must decide which scales to use.
Use a scenario analysis to evaluate the potential effects of the risks. For each identified risk on your list, develop a scenario describing what might happen and how much that event would cost your company. A good way of establishing a risk value is to take the percentage likelihood of the particular risk multiplied by the estimated cost it would represent. This allows you to rank the risks you identified according to their importance to your company.
Qualitative risk analysis is the process of evaluating the potential losses from a given risk using a combination of known information about the situation, knowledge about the underlying process, and judgment about the information that is not known or well understood. Some of the tools and techniques for qualitative risk analysis are:
Risk rating scales may be defined in quantitative and / or qualitative terms. Quantitative rating scales bring a greater degree of precision and measurability to the risk assessment process. However, qualitative terms need to be used when risks do not lend themselves to quantification, when credible data is not available, or when obtaining and analyzing data is not cost - effective.
Rating scales are not one - size - fits - all and should be defined as appropriate to enable a meaningful evaluation and prioritization of the risks identified and facilitate dialog to determine how to allocate resources within the organization. If risk scales are not standardized in your company, you must decide which scales to use.
Use a scenario analysis to evaluate the potential effects of the risks. For each identified risk on your list, develop a scenario describing what might happen and how much that event would cost your company. A good way of establishing a risk value is to take the percentage likelihood of the particular risk multiplied by the estimated cost it would represent. This allows you to rank the risks you identified according to their importance to your company.
Qualitative risk analysis is the process of evaluating the potential losses from a given risk using a combination of known information about the situation, knowledge about the underlying process, and judgment about the information that is not known or well understood. Some of the tools and techniques for qualitative risk analysis are:
- Risk probability and impact assessment. This method consists on the investigation about the likelihood that each specific risk will occur and the potential effect on an organizational objective or goal such as cost, delivery, quality or performance (negative effects for threats and positive effects for opportunities), defining it in levels, through interview or meeting with relevant stakeholders and documenting the results.
- Probability and impact matrix. Risks rating for further quantitative analysis using a probability and impact matrix. Rating rules should be specified by the organization in advance. Risk matrix can be used to score the enterprise’s ability to recognize sources of risk and its willingness and abilities to manage those risks. The statements regarding risk are numerically scored to identify areas on which to focus, opportunities to emphasize and leverage areas of strength.
- Risk categorization. To be done in order to determine the areas of the organization most exposed to the effects of uncertainty. Grouping risks by common root causes can help you to develop effective risk responses.
- Risk urgency assessment. In some qualitative analyses the assessment of risk urgency can be combined with the risk ranking determined from the probability and impact matrix to give a final risk sensitivity rating. Example: a risk requiring a near - term responses may be considered more urgent to address.
- SWOT (Strengths, Weaknesses, Opportunities and Threats) analysis. As you refine your understanding of risks, you can perform SWOT analysis to arrive at ways to mitigate these risks and manage them in the future. It consists of listing the strengths, weaknesses, opportunities and threats associated with your company's ability to withstand or eliminate each risk.
- ICOR (Improvements, Challenges, Opportunities and Risks) analysis. This approach melds risk management practices with the SWOT analysis to focus on the risks and benefits associated with a process change. The ICOR chart, adapted from a SWOT template, puts in plain view not only the improvements expected, but also any challenges that will be faced, any opportunities to be realized elsewhere and any risks involved with the activity.
The act of formally documenting improvements, challenges, opportunities and risks focuses the team on all of the ramifications of the activity. As an aid for quick interpretation, the squares of potentially “good” outcomes are shaded in green, and the potentially “bad” outcomes are in yellow. If a glance at the chart shows many more notations on the yellow side, it is a pretty good indication that the team should proceed carefully and make an effort to effectively manage the challenges and risks so as to not affect adversely operations elsewhere.
- Improvements: here the team thinks about what should be changed to facilitate the major improvement. In a manufacturing situation, an improvement in throughput may also have underlying benefits of scrap reduction, improved machine maintenance and improved routing.
- Challenges: As the team progresses into analysis, the challenges become more real and immediate. Knowing these challenges in the beginning, and tracking how they increase or decrease throughout the time, enables the risk team to plan for possible roadblocks and try to manage them effectively. The team may not know the answers to how to solve the challenges now, but knowing the questions in advance gives them an advantage if the challenge materializes.
- Opportunities: Where else can the risk team slide these improvements?. Is it possible that with a little tweak they can gain an improvement and related cost advantage in another area?. That is what the team wants to know to complete this part of the chart. Methods used can be adapted to similar products and put into new strategies.
- Risks: This category is the devil’s advocate of the analysis. It really does not do any good, for example, to improve productivity in one area if that change results in a productivity decrease in another. In the worst case, the improvement may actually be a detriment if the productivity loss in another area results in lost customers. As the size of the organization or company decreases, the effects of risk increase. It is important for the risk team to understand the risks associated with what they are doing; they do not want a situation where “the operation was a success, but the patient died”.
- Improvements: here the team thinks about what should be changed to facilitate the major improvement. In a manufacturing situation, an improvement in throughput may also have underlying benefits of scrap reduction, improved machine maintenance and improved routing.
- Challenges: As the team progresses into analysis, the challenges become more real and immediate. Knowing these challenges in the beginning, and tracking how they increase or decrease throughout the time, enables the risk team to plan for possible roadblocks and try to manage them effectively. The team may not know the answers to how to solve the challenges now, but knowing the questions in advance gives them an advantage if the challenge materializes.
- Opportunities: Where else can the risk team slide these improvements?. Is it possible that with a little tweak they can gain an improvement and related cost advantage in another area?. That is what the team wants to know to complete this part of the chart. Methods used can be adapted to similar products and put into new strategies.
- Risks: This category is the devil’s advocate of the analysis. It really does not do any good, for example, to improve productivity in one area if that change results in a productivity decrease in another. In the worst case, the improvement may actually be a detriment if the productivity loss in another area results in lost customers. As the size of the organization or company decreases, the effects of risk increase. It is important for the risk team to understand the risks associated with what they are doing; they do not want a situation where “the operation was a success, but the patient died”.
- Expert judgment. Individuals who have experience with similar situations in the not too distant past may use their judgment through interviews or risk facilitation workshops.
- Risks in any organization can be foreseen by using past experiences and practices as your guide. Include your teams and stakeholders at risks meetings to discuss potential risks.
- Risk categorization and ranking for each risk.
- Prioritized list of risks.
- Further understanding of the risk in the organization.
- A decision about go / no go actions and measures for risk treatments.