4.4 Prioritizing & Tracking Risks
Key Takeaways
- Beyond probability and impact, qualitative analysis uses parameters like urgency, proximity, dormancy, manageability, controllability, detectability, strategic impact, and propinquity.
- Proximity is how soon a risk could occur; urgency is how soon a response must be put in place — near-term, urgent risks rise in priority.
- Low-priority risks are placed on a watch list and reviewed periodically rather than ignored, since their priority can change.
- Detectability measures how easily a risk's onset can be sensed in advance; low detectability risks deserve higher priority despite low scores.
- The prioritized risk list feeds risk response planning and selects which risks proceed to quantitative analysis.
Beyond Probability and Impact
Probability and impact set the baseline ranking, but qualitative analysis often weighs additional parameters to sharpen the order. The PMI-RMP expects you to recognize each of these terms and what it measures.
Why it matters: two risks with identical PI scores can have very different real priority. One might strike next week and be undetectable; the other is years away and gives ample warning. The extra parameters surface that difference so the team focuses effort where timing and controllability demand it.
These parameters are sometimes captured as a single risk urgency assessment or folded into a composite priority. Whichever method the project's risk management plan defines, the goal is the same: turn a flat probability-impact ranking into a decision-ready order that reflects timing, manageability, and stakeholder concern.
The Key Parameters
| Parameter | What it measures |
|---|---|
| Urgency | How soon a response must be in place to be effective |
| Proximity | How soon the risk could actually occur |
| Dormancy | Time between the risk occurring and its impact becoming apparent |
| Manageability | How easily the risk owner can manage the risk |
| Controllability | The degree to which the owner can control the outcome |
| Detectability | How easily the risk's onset can be detected in advance |
| Strategic impact | Effect on the organization's strategic goals |
| Propinquity | How significant the risk is perceived to be by stakeholders |
Reading the Parameters
- Urgency vs proximity is a classic trap: proximity = how soon the risk occurs; urgency = how soon you must act. A distant risk can still be urgent if the response takes a long time to set up.
- Dormancy matters because a risk may hit silently and only reveal its damage later.
- Detectability is inverse to priority: a risk you cannot see coming is more dangerous and ranks higher even with a modest PI score.
- Propinquity captures stakeholder perception — a risk felt as personally significant gets more attention regardless of objective score.
Building the Prioritized List
The team combines the PI score with the relevant parameters to produce a prioritized list of individual project risks. This list is the primary output of qualitative analysis and directly drives where management attention and response effort go.
Near-term, high-impact, low-detectability, low-controllability risks rise to the top. The prioritization is documented in the risk register so the reasoning is transparent and can be challenged or revised at the next review.
The prioritized list is not static. Because qualitative analysis repeats throughout the project, the order is re-derived at each cycle as ratings change, new risks appear, and old ones close. A risk's climb or fall in the list is itself a signal worth communicating in the risk report.
The Watch List
Low-priority risks are not deleted — they are placed on a watch list within the risk register and reviewed periodically. This is a frequently tested point: low-priority does not mean ignored.
Why keep them? Risk priority is dynamic. A risk that is low-priority today can climb as its proximity nears, as new information arrives, or as the project context changes. Periodic re-review of the watch list catches that movement before a once-minor risk becomes a live threat.
Near-Term vs Long-Term Risks
Prioritization also separates risks by timing:
- Near-term risks (high proximity / urgency) need response plans and resources soon; they often jump the queue regardless of PI score.
- Long-term risks (low proximity) can be monitored on the watch list, with detailed response planning deferred until they approach — provided the response does not require long lead time.
The response lead time is the deciding factor: a long-term risk whose response takes months to arrange becomes urgent today.
A practical rule of thumb: compare each risk's proximity (time until it could occur) against its response lead time (time needed to prepare the response). When lead time approaches or exceeds proximity, the risk demands action now, even if it sits mid-pack on the probability-impact matrix. This is exactly the urgency-versus-proximity reasoning the exam tests, and it explains why timing parameters can override raw PI score in the prioritized list.
Outputs & What Comes Next
The outputs of Perform Qualitative Risk Analysis flow forward:
- Risk response planning (Chapter 6) — the prioritized list determines which risks get response strategies and owners first.
- Quantitative analysis (Chapter 5) — only the highest-priority risks usually proceed to numerical modeling (Monte Carlo, EMV, decision trees), because quantitative analysis is effort-intensive and optional.
- Risk register and report updates — ratings, categories, priorities, watch-list entries, and the overall-risk picture are refreshed.
Exam takeaway: qualitative analysis is the filter that decides where deeper analysis and response effort are spent. It rarely changes a risk's underlying nature; it changes where the team aims its limited attention. Treat the prioritized list and the watch list as the two parallel outputs — one drives immediate response and quantitative modeling, the other holds risks for periodic re-review until their priority shifts.
A risk has a moderate probability-impact score, but the team cannot sense it coming and a response would take three months to arrange, while the risk could materialize within four months. Which factors most justify raising its priority?
What is the correct treatment of risks assessed as low priority during qualitative analysis?