PMGT5891 Chap.4 Qualitative Risk Assessment and the Risk Register
Qualitative Risk Assessment and the Risk Register
Qualitative assessment is how most teams first sort a long list of risks. Each risk is rated for likelihood and consequence on short ordered scales, plotted on a probability-impact matrix or heat map, scored and ranked, and then compared with the organisation's appetite.
This chapter works through those steps using the Wellcome Trust likelihood and impact keys, sets out Baccarini's warnings about what matrix numbers can and cannot tell you, and reviews the tools used to gather expert judgement, from structured interviews to Delphi. It closes with the risk register: the fields each row needs, the five roles the register plays, and why every risk needs a named owner.
What this chapter covers
- 01
Coarse risk analysis and discretised rating scales
- 02
Wellcome Trust likelihood bands and four impact dimensions
- 03
Building and reading a five-by-five heat map
- 04
Scoring, ranking and tie rules
- 05
Comparing scores with a stated risk appetite
- 06
Limits of the probability-impact matrix
- 07
Interviews, questionnaires, Delphi, nominal groups and scenarios
- 08
Risk register fields, roles and the risk owner
Worked example · free
How a non-linear consequence scale reorders three risks
- +1Linear scores: A = 5 x 2 = 10; B = 2 x 4 = 8; C = 3 x 3 = 9. Ranking: A (10), then C (9), then B (8).
- +1Non-linear scores: A = 5 x 3 = 15; B = 2 x 9 = 18; C = 3 x 5 = 15.
- +1Ranking: B (18) first. A and C tie on 15; C has the higher consequence (Moderate against Minor), so C is second and A third. The order has fully reversed from A, C, B to B, C, A.
- +1The scores are ordinal. B's 18 does not make it 1.2 times as risky as A's 15, and the three scores must not be added into a project risk total of 48.
Key terms
- Risk register
- A risk register is the document that records each identified risk with its ratings, treatment, owner, timetable and status, and it serves as the project's repository, communication tool and audit trail for risk.
- Probability-impact matrix
- A probability-impact matrix is a grid that combines a likelihood rating and a consequence rating into an overall rating, usually divided into zones such as low, medium, high and extreme.
- Risk owner
- A risk owner is the individual who answers for a particular risk and holds the power to act on it, which is how ISO 31000:2018 frames the role.
- Delphi technique
- The Delphi technique is a structured method in which experts give anonymous estimates over several rounds, each round informed by a summary of the last, until their views converge.
Qualitative Risk Assessment and the Risk Register FAQ
How do you build a 5x5 risk matrix?
Define five likelihood bands and five consequence bands tailored to your organisation, for example probability ranges and dollar or schedule thresholds. Multiply or combine the two ratings for each cell, colour the cells into zones, and agree in advance which zones need treatment and how ties will be broken.
What should a risk register include?
At minimum: an identifier, a specific description, areas affected, root causes, likelihood and consequence levels, the overall rating, the chosen treatment, residual risk, a named owner, a timetable, resources, status and any secondary risks the treatment creates. The description, cost estimate, assumptions and contingency plan should also agree with one another.
What is wrong with using a risk matrix?
Ratings are subjective, the matrix covers event uncertainty only, a range of possible outcomes is forced into one level, and risks in the same zone cannot be ranked against each other. The numbers are ordinal, so a risk scored 20 is not twice as risky as one scored 10.
Is Delphi better than brainstorming for rating risks?
It depends on the situation. Delphi suits experts in different places and removes the sway of dominant voices through anonymity, but it is slow to run and participants may drop out. Brainstorming is faster and builds ideas in the room, which suits generating options more than producing calibrated ratings.
Exam move
Practise the full chain on a small original case until it takes you under ten minutes: write five risk statements, rate each on likelihood and consequence, multiply, rank with a stated tie rule, and mark which ones breach an appetite threshold you set yourself.
Then redo the same case with a non-linear consequence scale and note which ranks move; being able to explain that movement shows you understand that matrix scores are ordinal. Learn the Wellcome Trust likelihood bands, because they give each word a percentage and a time meaning. For the register, memorise the fields as a sequence of questions: what is the risk, how bad, what are we doing, who owns it, by when, and is it done.
Finally, pick one qualitative tool and be ready to give one situation where it fits and one cost of using it.
Working through Qualitative Risk Assessment and the Risk Register in PMGT5891? Sia is AskSia’s AI Project Management tutor — ask any PMGT5891 Qualitative Risk Assessment and the Risk Register question and get a clear, step-by-step explanation grounded in how PMGT5891 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
