What are the basic formulas used in quantitative risk assessment?

Project managers should be prepared to perform different types of risk analysis. For many projects, the quicker qualitative risk assessment is all you need. But there are occasions when you will benefit from a quantitative risk analysis.

Let’s take a look at this type of analysis: What is it? Why should we perform it? When should it be performed? And how do we quantify risks?

What is Quantitative Risk Analysis?

Quantitative risk analysis is a numeric estimate of the overall effect of risk on the project objectives such as cost and schedule objectives. The results provide insight into the likelihood of project success and is used to develop contingency reserves. 

More...

Individual risks are evaluated in the qualitative risk analysis. But the quantitative analysis allows us to evaluate the overall project risk from the individual risks plus other sources of risks.

Better Business Decisions

Business decisions are rarely made with all the information or data we desire. For more critical decisions, quantitative risk analysis provides more objective information and data than the qualitative analysis. Keep in mind: While the quantitative analysis is more objective, it is still an estimate. Wise project managers consider other factors in the decision-making process.

Better Estimates

A project manager estimated a project's duration at eight months with a cost of $300,000. The project actually took twelve months and cost $380,000. What happened?

The project manager did a Work Breakdown Structure (WBS) and estimated the work. However, the project manager failed to consider the potential impact of the risks (good and bad) on the schedule and budget.

First, we identify risks. Then we can evaluate the risks qualitatively and quantitatively.

Consider using Quantitative Risk Analysis for:

• Projects that require a Contingency Reserve for the schedule and budget.
• Large, complex projects that require Go/No Go decisions (the Go/No Go decision may occur multiple times in a project).
• Projects where upper management wants more detail about the probability of completing the project on schedule and within budget.

What is the Difference Between Qualitative and Quantitative Risk Analysis?

Quantitative Risk Assessment Tools & Techniques

Quantitative Risk Analysis tools and techniques include but are not limited to:

• Three Point Estimate – a technique that uses the optimistic, most likely, and pessimistic values to determine the best estimate.
• Decision Tree Analysis – a diagram that shows the implications of choosing one or other alternatives. 
• Expected Monetary Value (EMV) – a method used to establish the contingency reserves for a project budget and schedule.
• Monte Carlo Analysis – a technique that uses optimistic, most likely, and pessimistic estimates to determine the total project cost and project completion dates. For example, we could estimate the probability of completing a project at a cost of $20M. Or what is a company wanted to have an 80% probability of achieving its cost objectives. What is the cost to achieve 80%?
• Sensitivity Analysis – a technique used to determine which risks have the greatest impact on a project.
• Fault Tree Analysis (FMEA) – the analysis of a structured diagram which identifies elements that can cause system failure.

Quantitative Risk Analysis Example

Let’s look at a simple Expected Monetary Value (EMV) example:

Keep in mind that risks include both threats and opportunities. Threats have adverse impacts on cost. Opportunities are benefits that reduce cost. Expected Monetary Value = Probability x Impact.

Notice we subtracted the benefit of the Opportunity from the EMV. The Total EVM represents the project risk exposure and the amount of our Contingency Reserve.

Once you've performed the Quantitative Risk Analysis, be sure to update your risk register with the additional risk information.

The goal of risk management is to deliver optimal security at a reasonable cost. When diving into quantitative risk analysis, you have to think about cost versus benefit, risk handling and types of countermeasures.

Risk is related to vulnerabilities, which threaten confidentiality (C), integrity (I) and availability (A) of the assets. This is described as the CIA Triad.

Confidentiality is about not disclosing sensitive information to other people.

Integrity is about preserving the state of the system — we don’t want attackers to change our data.

We do want our systems to be up and running. Hence availability is considered.

What is quantitative analysis?

Quantitative analysis is about assigning monetary values to risk components. Let’s analyze the example of hard drive failure to better understand how it works.

Let’s first describe the threat, vulnerability and risk:

1. Threat — hard drive failure
2. Vulnerability — backups done rarely
3. Risk — loss of data

The asset is data. The value of the asset (AV) is assessed first — $100,000, for example.

Let’s discuss the single loss expectancy (SLE). It contains information about the potential loss when a threat occurs (expressed in monetary values). It is calculated as follows: SLE = AV x EF, where EF is the exposure factor.

Exposure factor describes the loss that will happen to the asset as a result of the threat (expressed as percentage value). SLE is $30,000 in our example, when EF is estimated to be 0.3.

Let’s continue this case. Annualized rate of occurrence (ARO) is described as an estimated frequency of the threat occurring in one year. ARO is used to calculate ALE (annualized loss expectancy). ALE is calculated as follows: ALE = SLE x ARO. ALE is $15,000 ($30,000 x 0.5), when ARO is estimated to be 0.5 (once in two years).

As we can see, the risk is about the impact of the vulnerability on the business and the probability of the vulnerability to be exploited.

Cost and benefit analysis for risk

Let’s continue the example from the previous section. Annualized loss expectancy (ALE) is $15,000. This means that the potential loss is $15,000 in one year, when the data is lost as a result of the hard drive failure. A countermeasure can be used to reduce the potential loss. It happens when the management decides to reduce the risk. This countermeasure should not cost more than $15,000 per year. Otherwise it wouldn’t be logical from a business point of view (we don’t want to spend more money than we can potentially lose). This is basically how cost and benefit analysis works.

Let’s see how the annual value of the countermeasure to the company (COUNTERMEASURE_VALUE) can be calculated:

COUNTERMEASURE_VALUE = ALE_PREVIOUS – ALE_NOW – COUNTERMEASURE_COST, where

ALE_PREVIOUS: ALE before implementing the countermeasure

ALE_NOW: ALE after implementing the countermeasure

COUTERMEASURE_COST: annualized cost of countermeasure (please note that it’s not only purchasing cost — maintenance cost is included).

Risk handling for security

Risk can be handled in the following ways:

• Risk reduction — risk is reduced to an acceptable level (countermeasures implemented; types of countermeasures are described in the next section).
• Risk avoidance — stopping the activity, which leads to the risk.
• Risk transference — the risk is transferred to the insurance company.
• Risk acceptance — accepting the cost of potential loss (no countermeasures).

Countermeasures for risk reduction

Let’s discuss the types of countermeasures (also called controls) that are implemented in the case of risk reduction. There are three types of countermeasures:

• Administrative (security awareness training should not be forgotten, because people are the weakest point in the security chain)
• Technical (firewall)
• Physical (locks)

Countermeasures are implemented to reduce the risk. We talk about total risk when no countermeasure is implemented. Let’s assume now that the countermeasure is implemented. Perfect security doesn’t exist and there is some risk left. This is a residual risk.

Quantitative risk analysis is important for every business. Single loss expectancy (SLE), exposure factor (EF), annualized rate of occurrence (ARO) and annualized loss expectancy (ALE) are all key parts of figuring out the cost and benefit associated with risk. Learning how to handle and countermeasure risk is important.