The Origins of Risk Management
Risk management can be traced back to the beginning of human origins, but it was only towards the end of the 19th century, when high-rise buildings, complex railway infrastructures, large dams and canals started being built, that formalised project risk management techniques were applied to help control projects. At that stage, however, risk management techniques were all still largely qualitative. This meant the management of risks focussed on identifying the source of the risk (threat or opportunity) which was then analysed subjectively to establish the likelihood of risk event occurrence and then the potential impacts of this risk event were identified. This 3-step process of; identify the source, evaluate the probability of occurrence, and determine the likely impacts, remains the foundation of qualitative risk analysis today.
The Development of Quantitative Risk Analysis
The first known quantitative risk analysis method was developed by Henry Gantt in 1917 in the form of the Gantt chart which, at the time, was used exclusively for schedule risk analysis. These days, Gantt charts are commonly used in many project planning reports but, in terms of Quantitative Risk Analysis, the available methods have evolved and diversified greatly, providing us with a range of options specific to different risk types and their impacts. Quantitative Risk Analysis methods include, amongst others, Monte-Carlo Analysis, Layers of Protection Analysis (LOPA), Failure Mode and Effect Analysis (FMEA), Markov Analysis, and Bayesian Analysis. Most of these methods will be meaningless to all but trained Risk Engineers and Managers, so let me try and summarise the difference between qualitative and quantitative risk analysis in generic terms.
BROWSE RISK MANAGEMENT TRAINING COURSES
A Generic Comparison Between Qualitative and Quantitative Risk Analysis
In a nutshell, Qualitative Risk Analysis applies a purely subjective assessment of both the likelihood of risk event occurrence (probability) and the risk outcome (impact) to determine the overall severity of the risk. Quantitative Risk Analysis, on the other hand, uses data that is both verifiable and relevant to predict the probability of a risk event occurrence and the outcome thereof. It is a common misconception that, if a risk has been evaluated by a subject matter expert who provides a numerical probability of risk event occurrence and a numerically defined impact, then this risk has been quantitatively analysed. This is not necessarily true.
Verifiable and Relevant Data in Quantitative Risk Analysis
The risk can only be deemed to have been analysed quantitatively if the data applied in the analyse is both verifiable AND relevant to the nature of the risk. For example, if a highly experienced aircraft pilot told you there was a 1% chance that they would crash their plane but, if they did, there would be a 90% chance they would be killed, would you consider that to be quantitative risk analysis? The answer is, not unless they could justify these figures with both verifiable and relevant data. That means they would have to demonstrate the validity of both the probability of crashing and the outcome by taking into account all the relevant parameters, such as the type of plane, its condition, the weather, their flying safety records etc. If they presented you with the flying safety record of a different pilot, flying exactly the same plane, in the same condition and weather, that data may be verifiable, but it would not be relevant as it pertains to a pilot with a different safety record. Similarly, if they presented you with the inspection reports and maintenance logs of the plane, but the planes identification number was given in the reports, this data would be relevant but not verifiable. In both casesthe risk analysis would fail the quantitative test due to the unreliability of the data being used.
Application of Quantitative Risk Analysis in Operating Facilities
For a more technical example of where quantitative risk analysis is applied on projects, consider an operating facility where there are inherent life-threatening risks, such as an oil & gas processing plant, refinery, timber mill, or a mine. In the design of these facilities, it is a mandatory requirement to carry out a technical safety Quantitative Risk Analysis (QRA) to evaluate the risk to personnel working on the facility. The primary objective of this type of QRA is to establish the Potential for Loss of Life (PLL) at any location on the facility by assessing the Individual Risk per Annum (IRPA) at that location multiplied by the expected number of personnel working there at any time. Design measures are then applied where necessary to ensure the PLL does not exceed the risk impact acceptance threshold, which is typically 1 x 10-4 p.a. (or one death in 10 thousand per year). This technical safety design practice is known as applying the ALARP (As Low as Reasonably Practical) principal, which is to ensure all safety risks on the facility are designed to be within the risk impact acceptance threshold.
Risk Calculation Formulae
IRPA is calculated by multiplying the Location Specific Individual Risk (LSIR) by the proportion of time an individual spends in that location, and PLL is calculated by multiplying the IRPA by the number of personnel working within the location. LSIR is calculated as the sum of the frequency of each anticipated Major Accident Event (MAE) multiplied by the probability of fatality due to an MAE at that location. These calculations are defined mathematically as follows:
LSIR = ∑ (F × P)
IRPA = LSIR x T
PLL = IRPA x N
Strengthen Your Enterprise Risk Management Capability
Understanding the distinction between qualitative and quantitative risk analysis is essential for professionals responsible for managing uncertainty, safeguarding operations, and strengthening decision-making processes across the organisation.
If you would like to deepen your practical understanding of enterprise-wide risk management principles and their real-world application, explore our Enterprise Risk Management training courses.
Visit our website and discover how our training courses can support your organisation’s risk management objectives.