The Skill
Qualitative risk analysis is a systematic process used to assess and prioritize identified risks. Unlike quantitative analysis, which relies on complex numerical data, this method uses descriptive scales—such as "high," "medium," and "low"—to rate the likelihood of a risk occurring and the potential severity of its consequences.
The core of the technique involves plotting these ratings on a risk matrix. This visual tool helps you quickly distinguish between minor risks that may require minimal monitoring and major risks that demand immediate attention and mitigation planning. It is a foundational skill for making rapid, informed decisions in risk management.
Why Is This Skill Important?
As a Physical and Infrastructure Asset Manager, you are responsible for the integrity and performance of critical assets. Resources, however—including time, budget, and personnel—are always finite. You cannot address every potential risk with the same level of urgency or investment.
Qualitative risk analysis provides a structured and defensible framework for prioritizing your efforts. It enables you to focus resources on the most significant threats to your infrastructure, whether it's a bridge, a power grid, or a water treatment facility. Mastering this skill ensures you can effectively manage risk, justify your decisions to stakeholders, and protect the value and function of your assets.
Your Task
You will perform a qualitative risk analysis for a set of identified risks at a municipal water treatment plant. Using the provided resources, you will define assessment scales, rate each risk's likelihood and consequence, determine its overall risk level using a standard risk matrix, and produce a final prioritized list of risks for the asset management team.
Your Procedural Checklist
- Review the list of identified risks for the water treatment plant.
- Use the provided internal memo to understand the standard scales for Likelihood and Consequence.
- For each risk, assign a Likelihood rating and a Consequence rating.
- Use the risk matrix to determine the final Risk Level for each item.
- Compile a prioritized list of risks, ordered from highest to lowest risk level.
Resources and Data
You have been provided with two key documents to complete your task. The first is a list of recently identified risks at the Northwood Water Treatment Plant. The second is an internal memo from the Office of Asset Integrity, which outlines the standardized scales and matrix you are required to use for your analysis.
Identified Risks: Northwood Water Treatment Plant
| Risk ID | Risk Description | Asset Affected |
|---|---|---|
| R-WTP-001 | Sudden mechanical failure of a primary raw water intake pump due to bearing wear, reducing plant inflow capacity by 50%. | Raw Water Pumping Station |
| R-WTP-002 | Extended power grid failure lasting more than 24 hours, exhausting backup generator fuel supply and causing a complete plant shutdown. | Main Electrical System & Backup Generators |
| R-WTP-003 | Unauthorized access to the SCADA system via a malware infection, potentially allowing for manipulation of chemical dosing levels. | SCADA Control System |
| R-WTP-004 | A rupture in a bulk sodium hypochlorite storage tank leading to a significant chemical spill and hazardous material incident. | Chemical Storage Facility |
| R-WTP-005 | Structural fatigue and crack propagation in a primary flocculation basin concrete wall, posing a risk of containment failure. | Flocculation Basin #3 |
| R-WTP-006 | Clogging and failure of multiple membrane filtration modules due to an unexpected algae bloom in the raw water source. | Membrane Filtration System |
Key Document: Internal Memo: Standard for Qualitative Risk Assessment
Detailed Steps
Follow this procedure to move from the raw list of risks to a final, prioritized action list.
Step 1: Understand the Scales
Before assessing risks, you must have a clear understanding of the tools you are using. The provided memo defines the specific criteria for both likelihood and consequence.
Likelihood
Consequence
Your first action is to thoroughly review the Likelihood and Consequence tables in the risk-management-standard-memo resource. Do not proceed until you are confident you understand the meaning of each rating level.
Step 2: Assess Each Risk
Go through the identified-risks-water-plant data set, one risk at a time. For each risk, perform the following two actions:
1. Assign a Likelihood Rating: Read the risk description and, using the standard scale, determine how likely it is to occur. For example, a risk involving aging equipment might be rated "High" (4), while a risk of a meteor strike would be "Very Low" (1).
2. Assign a Consequence Rating: Consider the potential impact if the risk occurred. A failure that causes a widespread service outage would be "Catastrophic" (5), while a minor leak with no service impact would be "Minor" (2).
Record your L and C ratings for each risk. It is good practice to also write a brief (one-sentence) justification for your choices.
Step 3: Use the Risk Matrix
With likelihood and consequence ratings for each risk, you can now determine the overall risk level. The risk matrix is your primary tool for this.
📊 View Diagram: Standard 5x5 Risk Matrix
To use the matrix, find the row corresponding to your Likelihood rating and the column for your Consequence rating. The cell where they intersect shows the final risk level.
Example: A risk with a Likelihood of 4 (High) and a Consequence of 5 (Catastrophic) would intersect at a cell labeled "Extreme". Record this risk level for each of your items.
Step 4: Prioritize the Risks
The final step is to organize your findings into a clear, actionable list. Reorder the risks from your analysis based on their final risk level.
The standard priority order is: 1. Extreme 2. High 3. Medium 4. Low
Pro Tip: Handling Ties
What if you have multiple risks at the same level (e.g., three 'High' risks)? A common best practice is to use the consequence rating as a tie-breaker. A High risk with a 'Major' consequence should be prioritized over a High risk with a 'Moderate' consequence. If they are still tied, they can be listed as equal priority or flagged for more detailed quantitative analysis.
Your final output should be a table or list that clearly shows each risk, its ratings, its final risk level, and its rank in the prioritized list.
An Expert Response
About This Expert Response
This is a sample response from a subject matter expert. Your own analysis may have slightly different ratings based on your professional judgment, and that is perfectly acceptable. The key is to ensure your ratings are logical and can be justified based on the provided scales. Focus on comparing your process and prioritization logic to this example.
Below is a completed qualitative risk analysis for the identified risks at the Northwood Water Treatment Plant.
Qualitative Risk Analysis: Northwood Water Treatment Plant
| Risk ID | Risk Description | Likelihood (L) | Consequence (C) | Risk Level | Justification |
|---|---|---|---|---|---|
| R-05 | Catastrophic failure of primary filtration pump due to age and lack of recent service. | 4 (High) | 5 (Catastrophic) | Extreme | The pump is old and critical for plant operation. Failure would cause a widespread service outage. |
| R-02 | Uncontrolled chlorine gas leak from a corroded valve in the main storage area. | 2 (Low) | 5 (Catastrophic) | High | While modern safety systems make this unlikely, the consequence of a major leak would be catastrophic for personnel and the nearby community. |
| R-03 | Cybersecurity breach allowing unauthorized remote access to SCADA control systems. | 3 (Medium) | 4 (Major) | High | The plant is connected to the internet, making it a target. A breach could lead to significant service disruption and equipment damage. |
| R-06 | Structural fatigue and cracking in the secondary sedimentation basin concrete walls. | 3 (Medium) | 3 (Moderate) | Medium | Visible wear suggests this is a plausible event in the medium term. Failure would cause a localized disruption and require costly repairs. |
| R-01 | Extended power outage from grid failure lasting more than 24 hours. | 2 (Low) | 3 (Moderate) | Medium | The facility has backup generators, but they are not rated for indefinite use. A prolonged outage would eventually disrupt service. |
| R-04 | Minor spill of sodium hypochlorite during routine delivery and transfer. | 4 (High) | 2 (Minor) | Medium | Minor spills are common in handling chemicals. Procedures are in place to contain them, resulting in minor cleanup costs and no service impact. |
Prioritized Risk List
- R-05 (Extreme): Catastrophic failure of primary filtration pump.
- R-02 (High): Uncontrolled chlorine gas leak. (Prioritized higher than R-03 due to catastrophic consequence rating).
- R-03 (High): Cybersecurity breach of SCADA systems.
- R-06 (Medium): Structural fatigue in sedimentation basin. (Prioritized higher than other Mediums due to higher L and C ratings).
- R-01 (Medium): Extended power outage.
- R-04 (Medium): Minor chemical spill during delivery.
Assess Yourself
Evaluate Your Work
Use the following criteria to perform a self-assessment of your qualitative risk analysis. Compare your work against the expert response, paying close attention to the process and rationale, not just the final answer.
- Procedural Accuracy: Did you follow all four steps of the process correctly and in the right order?
- Correct Use of Scales: Did you assign likelihood and consequence ratings that are consistent with the definitions in the standard memo?
- Matrix Application: Did you correctly identify the risk level in the matrix based on your L and C ratings for every risk?
- Prioritization Logic: Is your final list correctly ordered from highest to lowest risk level, and did you apply a logical tie-breaking rule if needed?
- Clarity of Justification: Is your reasoning for assigning specific ratings clear, concise, and defensible?
Learning Progress
In this activity, you have practiced the essential skills of qualitative risk analysis. You successfully defined and applied qualitative scales for likelihood and consequence, used a standard risk matrix to determine overall risk levels, and prioritized a list of identified risks based on your findings.
Next Steps
You have successfully completed this skill-building activity. Your ability to systematically prioritize risks is a critical competency for any asset manager. Please navigate back to the course to continue your learning journey.
