Risk assessment helps you judge the likelihood and consequences of a risk, consider existing controls and decide what needs attention. The right methodology depends on the decision, the evidence available and the complexity of the activity.
This guide explains six approaches used within assessment: quantitative analysis, qualitative assessment, SWOT, Delphi, Monte Carlo simulation and structured risk register reviews. They serve different purposes. SWOT helps frame the issues; a register records and supports review; neither replaces analysis of the risks themselves.
If you are still finding what could go wrong, start with our risk identification techniques.
1. Quantitative risk analysis
Quantitative analysis uses numerical estimates of probability, frequency or consequences, such as cost or delay. It can help compare options where you have a defensible basis for estimating outcomes.
For example, a project team might examine the financial effect of different delivery delays using evidence from comparable projects. Record the data, assumptions and range of uncertainty so decision makers can understand what the estimate depends on.
A numbered score is not necessarily a probability
Giving likelihood and impact categories numbers from one to five can help rank risks. NIST describes this use of categories and representative numbers as semi-quantitative assessment. Those numbers do not automatically measure the probability of an event or its expected financial loss. A score of four is not necessarily twice the risk of a score of two.
Use the result for its intended purpose and explain its limits. Avoid presenting a rough estimate as a precise forecast.
2. Qualitative risk assessment
Qualitative assessment uses defined descriptions, such as unlikely, possible, major or severe. It suits discussions where evidence is limited or consequences are difficult to express in a single financial measure.
Agree the meaning of each category before assigning ratings. Define the period being assessed, discuss the evidence and explain how existing controls affect the judgement. A likelihood-and-impact matrix can help organise the discussion, provided teams apply the same definitions.
For example, a service manager and an IT manager may interpret “major disruption” differently. Describing the effect on service delivery makes their ratings easier to compare.
Use scores as prompts for decisions. A low-frequency event with severe consequences may still need attention even if its overall score appears modest.
3. SWOT analysis
SWOT examines strengths, weaknesses, opportunities and threats. It helps set the context for assessment, especially when reviewing a strategy, new service or project.
Translate the findings into specific risks before rating them. A weakness such as reliance on a single supplier needs an explanation of what could happen and how it would affect the objective.
SWOT does not calculate likelihood, quantify losses or test whether a control works. Follow it with qualitative or quantitative analysis where appropriate.
4. Delphi technique
Delphi gathers expert judgement through repeated rounds of questions and feedback. It can help explore likelihood, consequences or uncertainty when specialist views differ and direct evidence is incomplete.
Select participants with relevant experience, ask clear questions and summarise both the range of responses and the reasons behind them. Later rounds let participants reconsider their views in light of the feedback.
As RAND's Delphi guidance describes, panels can expose disagreement as well as agreement. Treat the outcome as structured expert judgement, with assumptions and limitations recorded.
5. Monte Carlo simulation
Monte Carlo simulation explores possible outcomes by repeatedly sampling values from probability distributions in a model, as explained in the GAO Cost Estimating and Assessment Guide. A project team might use it to examine a range of completion dates or costs when several inputs are uncertain.
The usefulness of the output depends on the model, input ranges and relationships between variables. More simulation runs do not repair unsupported assumptions or missing dependencies.
Before using a simulation, ask:
- Is a model needed for the decision being made?
- What evidence supports the input distributions?
- Which inputs are connected rather than independent?
- How will we explain uncertainty to the people using the results?
Sensitivity analysis can help examine how changes in assumptions affect the output. This approach usually calls for specialist software and analytical expertise.
6. Structured risk register reviews
A risk register records the findings of assessment and provides a basis for ongoing review. The register itself is not an analysis technique: its value comes from the evidence, judgement and follow-up behind each entry.
At a review, ask whether the description is still accurate, controls are operating, ratings need to change and agreed actions are complete. Record the reasons for changes, rather than updating a score without explanation.
Useful fields include:
- The objective affected, risk description and owner.
- Existing controls and evidence about their operation.
- Likelihood, impact and the basis for the ratings.
- Further actions, responsibilities and due dates.
- Review dates and changes in circumstances.
See our risk assessment example for a worked set of fields. RiskMate provides an online register, action tracking and reports to support this work.
How to choose a risk assessment methodology
Start with the question the assessment needs to answer. A routine review may need consistent qualitative ratings; an investment decision may justify more detailed numerical analysis. You can combine approaches when each adds useful information.
The HM Treasury Orange Book recognises qualitative, quantitative and combined analysis, with detail proportionate to purpose, evidence and resources.
Before selecting a method, agree the scope, assessment period, criteria and decision owner. Explain where evidence is weak and when the assessment should be revisited. The aim is a reasoned decision and a workable response, rather than the most elaborate model.
Common questions about assessment methods
Is qualitative or quantitative assessment better?
Neither is best in every situation. Qualitative assessment can support a consistent discussion; quantitative analysis can explore numerical outcomes where data and assumptions support it. Both need judgement and review.
Can you quantify risk when data is limited?
You can explore estimates and ranges, but make their basis clear. Do not turn uncertainty into a single confident figure. Expert input, scenarios and sensitivity checks can help expose assumptions that need further investigation.
What happens after assessment?
Agree whether further action is needed, allocate responsibility and review the result through your risk management process. Our guide to assessment challenges explains how to handle data gaps, bias and changing circumstances.