4.1Risk identification & analysis

For a project manager (PM), the starting point of risk management is not "eliminate every risk," but judging which risks a limited contingency reserve should be allocated to, and how much, in order to reduce expected loss most efficiently. Preparing an equally thick response for every risk inflates cost, while underweighting risk leaves the team unable to act when a major risk materializes. This section covers the full flow from identifying and recording risks, through qualitative analysis that ranks them, to quantitative analysis (EMV) that verifies whether a response is monetarily worthwhile—framed around the practical goal of contingency-reserve allocation.

4.1.1Risk identification and the risk register

• Risk identification is the activity of surfacing uncertain events that could affect a project, using techniques such as brainstorming, checklists, expert interviews, and lessons from past projects (a lessons-learned repository). Each identified risk is recorded in a risk register—a document listing each risk's description, cause, potential impact, current response status, and owner (the risk owner)—which is shared and continually updated across the project.
• A practically important point is that risk identification is not a one-time activity performed only at project kickoff, but an ongoing activity repeated at every phase transition and whenever circumstances change. New risks can arise mid-project (from requirement changes, staff turnover, shifts in the external environment, and so on), and if the risk register is not kept updated, the team ends up facing later risks with no advance preparation whatsoever.

4.1.2Qualitative risk analysis (the probability/impact matrix)

• Qualitative risk analysis places each identified risk on a probability/impact matrix—probability (high/medium/low) x impact (large/medium/small)—to rank responses in relative priority. Because it does not strictly convert values into monetary terms, it can be performed quickly and suits screening early in a risk-heavy project. A risk with "low probability but severe impact" may appear at a moderate position on the matrix, yet in practice the PM must judge that it warrants elevated priority and active monitoring, because overlooking it could be catastrophic.
• Note that qualitative analysis is a first-pass screening for prioritization and cannot by itself judge whether a given response is monetarily worthwhile. A "large impact" rating does not automatically justify an unconditionally expensive response; comparing response cost against expected loss requires the quantitative risk analysis covered next.

4.1.3Quantitative risk analysis and expected monetary value (EMV)

• Quantitative risk analysis converts risk into monetary (or schedule) terms for numerical evaluation; its representative techniques are expected monetary value (EMV) and decision tree analysis. EMV = probability of occurrence x impact amount, and when multiple response options exist, the EMV (the expected value net of response cost) is used as the basis for choosing the most favorable option. An opportunity (positive impact) is represented by a positive EMV, and a threat (negative impact) by a negative EMV.
• Decision tree analysis represents multiple options and the uncertain events (with associated probabilities) that follow each one as a tree diagram, summing the EMV along each branch to select the decision path with the most favorable expected value. Because probability and impact amount are multiplied and summed at each branch, care is needed to avoid the mistake of judging by the largest impact amount or the highest probability alone, which can lead to choosing an option that is actually inferior on an expected-value basis.

Suppose a PM is comparing two response options for the risk of a delayed supply of a key component from an external vendor. Option A involves pre-contracting a backup supply route for an additional 200 million yen, which would reliably avoid the delay if contracted. Option B involves accepting the delay risk and doing nothing, paying an additional expedited-shipping fee (10,000,000 yen) only if the delay actually occurs, and prior information estimates the probability of this component delay at 30%. Manually verifying the EMV: Option B's expected loss is 0.3 x 10,000,000 yen = 3,000,000 yen. Option A incurs a fixed cost of 2,000,000 yen regardless of whether the delay occurs, so its expected cost is fixed at 2,000,000 yen. Since 3,000,000 yen (Option B's expected loss) is greater than 2,000,000 yen (Option A's certain cost), the expected-value-based judgment favors Option A (pre-contracting the backup supply route). A common mistake here is the intuitive judgment that "since the 30% probability is under half, Option B—doing nothing in most cases—is the better deal." EMV is an expected value that multiplies not just probability but also the magnitude of the impact amount, so even a low-probability risk can have an EMV exceeding a certain response cost when the impact amount is very large—which is exactly the situation here. Another point to note is that Option A's cost corresponds to the avoid risk-response strategy (removing the risk entirely), whereas Option B corresponds to the accept strategy (taking no action, and dealing with the risk only if it materializes)—two different risk-response strategies. Weighing both the numerical comparison and the nature of the strategies is the PM's role.

4.1.4Section summary

• The risk register is the record of an ongoing identification activity, updated at every phase transition and change in circumstances
• Qualitative analysis (probability x impact matrix) gives fast prioritization; quantitative analysis (EMV) judges worthwhileness via monetary comparison against response cost
• EMV = probability x impact amount. Even with a low probability, EMV can exceed the response cost when the impact amount is extreme