A Brief History of Risk Analysis
Risk management can be traced back to the beginning of human history, but it was only towards the end of the 19th century — as high-rise buildings, complex railways, dams, and canals started being built — that formalised project risk management techniques emerged. At that stage, techniques were still largely qualitative: identifying the source of a risk (threat or opportunity), then subjectively assessing the likelihood of occurrence and its potential impact. That three-step process — identify the source, evaluate probability, determine likely impact — remains the foundation of qualitative risk analysis today.
The first known quantitative method was Henry Gantt’s 1917 Gantt chart, originally used for schedule risk analysis. Quantitative methods have since diversified considerably, including Monte Carlo analysis, Layers of Protection Analysis (LOPA), Failure Mode and Effect Analysis (FMEA), Markov analysis, and Bayesian analysis — most of which will mean little to anyone outside a trained risk engineering role.
Qualitative vs. Quantitative: The Core Difference
In simple terms: qualitative risk analysis applies a subjective assessment of both likelihood and impact to determine overall severity. Quantitative risk analysis uses data that is both verifiable and relevant to predict the probability and outcome of a risk event. It’s a common misconception that any risk assigned a numerical probability and impact by a subject matter expert has therefore been analysed quantitatively — that’s only true if the underlying data is both verifiable and relevant. If an experienced pilot claims a 1% chance of crashing and a 90% chance of fatality if they do, that’s only quantitative if they can back those figures with data relevant to the specific plane, its condition, the weather, and their own flying record — not, say, another pilot’s safety record on the same aircraft type, which would be verifiable but not relevant.
Quantitative Analysis in Safety-Critical Design
For facilities with genuine life-safety risk — an oil & gas processing plant, refinery, timber mill, or mine — a technical safety Quantitative Risk Analysis (QRA) is a mandatory design requirement. Its primary objective is establishing the Potential Loss of Life (PLL) at any location on the facility, by assessing the Individual Risk per Annum (IRPA) at that location multiplied by the expected number of personnel present. Design measures are then applied so PLL doesn’t exceed the acceptance threshold — typically 1 in 10,000 per year — a practice known as applying the ALARP (As Low As Reasonably Practical) principle.
IRPA is calculated by multiplying Location Specific Individual Risk (LSIR) by the proportion of time spent in that location; PLL by multiplying IRPA by the number of personnel present; and LSIR as the sum of each anticipated Major Accident Event’s frequency multiplied by its probability of fatality. These calculations are defined mathematically as follows:
LSIR = ∑ (F × P)
IRPA = LSIR x T
PLL = IRPA x N
Why We Built Project Risk Manager for Qualitative Analysis
Quantitative risk analysis is essential where minimising uncertainty is the primary goal, but it’s rarely required for managing the risks encountered in day-to-day project management. For these, qualitative analysis is usually the more practical approach — quicker, cheaper, and generally just as effective. It’s on this basis that we built Project Risk Manager, a web-based platform that applies PMI–PMBOK and ISO 31000 guidelines, with a fully configurable risk matrix, to help project teams identify, analyse, and control risk on projects of any size.
Project Risk Manager puts this qualitative approach into practice as a fully configurable platform. See how it works or book a free demo. The Basic plan is free for up to two active team members, so it costs nothing to try.
Have a question about where qualitative analysis stops, and quantitative analysis should start on your project? Get in touch — we’d be happy to help.