What it means
Risk analysis sits between spotting risks and doing something about them. Identification produces a list, analysis turns that list into a ranked and, where possible, costed picture, and only then can a management team decide what to fix first.
It matters because attention and money are limited. Without analysis, teams tend to react to whatever risk was mentioned most recently or most loudly, which usually means the noisy small exposures get resources while the quiet large ones do not.
Analysis comes in two flavours that are often used together. Qualitative analysis scores likelihood and impact on a simple scale, typically one to five, and is fast enough to run across dozens of risks in a workshop; quantitative analysis attaches real money and real probabilities and is reserved for the handful of exposures big enough to justify the effort.
The main quantitative techniques are expected monetary value, sensitivity analysis and scenario modelling. Expected monetary value multiplies probability by impact, sensitivity analysis flexes one variable at a time to see which assumptions the answer really depends on, and scenario modelling builds coherent best, base and worst cases rather than moving inputs in isolation.
The most common failure in risk analysis is false precision. A probability estimated by three people in a meeting does not become more reliable because it is written to one decimal place, so good analysts show the range, state the assumptions and revisit the numbers when new information arrives.
In practice
Real-world examples
Example 1
A retailer analyses the risk of a warm winter on its coat range. Historical sales suggest a mild season occurs roughly one year in four and would leave about $700,000 of stock unsold at full price, so the buying team reduces the initial order and negotiates a mid-season top-up option.
Example 2
An insurance broker runs a sensitivity analysis on its three-year plan and finds that profit is far more sensitive to staff retention than to new client wins. A five percentage point rise in staff turnover costs more than losing two mid-sized accounts, which redirects the improvement budget towards pay and progression.
Example 3
A hospital trust analyses the risk of a critical scanner failing. The machine is nine years old, failure within twelve months is judged 20% likely, and a failure would cost roughly $450,000 in outsourced scans and cancelled appointments, giving an expected cost of $90,000 against a $60,000 service contract.
Think of it
Risk analysis is much like checking the weather forecast before planning an outdoor event. You cannot stop it from raining, but knowing the chance of a downpour helps you decide whether to rent a marquee or just bring umbrellas.
Formula
Calculation
The workhorse calculation is expected monetary value, which is then summed across the risk register to size a contingency.
Expected monetary value = Probability x Financial impact
A construction firm analyses three risks on a $9,000,000 project. Risk A is a planning delay, judged 40% likely with an impact of $300,000. Risk B is a specialist subcontractor failing, judged 15% likely with an impact of $800,000. Risk C is a ground contamination find, judged 5% likely with an impact of $1,200,000.
Risk A: 0.40 x $300,000 = $120,000
Risk B: 0.15 x $800,000 = $120,000
Risk C: 0.05 x $1,200,000 = $60,000
Total expected monetary value = $120,000 + $120,000 + $60,000 = $300,000
The firm sets a contingency reserve of $300,000, which is 3.3% of the $9,000,000 contract value. Notice that Risk A and Risk B carry the same expected cost despite very different profiles, so the analysis also flags that Risk C, though cheapest on average, is the one that could break the project's cash flow if it lands.Case study
Seen in the real world
Calderwood Logistics is an illustrative, fictional haulier used to show risk analysis in practice. Calderwood's board had a risk register with forty-one entries, all coloured red, amber or green by feel, and no one could say which three mattered most. Meetings about it had become a ritual with no decisions attached.
The new operations director scored every entry on likelihood and impact from one to five, then costed the top eight in real money. Two exposures dominated: a fuel price spike, judged 30% likely in a year with a $1,400,000 impact, giving an expected cost of $420,000; and driver shortages, judged 50% likely with a $500,000 impact, giving $250,000. Together those two accounted for $670,000 of expected cost, while the remaining thirty-nine entries came to less than $200,000 combined.
Calderwood hedged half its annual fuel volume and funded an apprentice driver scheme. The register still had forty-one entries, but the board now spent its risk time on two of them and delegated the rest to line managers with quarterly reporting.
Watch out
Common mistakes
- Scoring every risk as high because no one wants to be the person who marked something low, which leaves the register useless for prioritising.
- Analysing risks once at the start of a project and never revising the numbers as evidence arrives, so the analysis describes a world that no longer exists.
- Adding up expected monetary values and treating the total as the amount that will actually be spent, when in reality each individual risk either happens in full or not at all.
Questions
People also ask
What is the difference between risk analysis and risk assessment?
Analysis is the measuring step that produces likelihoods and impacts, while assessment is the wider process that also identifies the risks and judges them against the appetite the business has set.
Do small businesses need formal risk analysis?
They need the thinking but rarely the paperwork: a one-page list of the five things that could seriously damage the business, each with a rough probability and cost, delivers most of the benefit.
How do you estimate probability with no historical data?
Use structured judgement from several independent people, anchor on comparable events elsewhere in the industry, and express the answer as a range rather than a single figure.