Risk analysis is the work of finding what could go wrong and deciding how much it matters. Done well it produces two things: a ranked list of what to worry about, and a defensible number for how much money to set aside. The free templates below are editable MS Word files, and beneath them you’ll find how to identify risks systematically, how to score them, and how to turn those scores into a contingency figure you can justify.
Analysis or Management Plan?
Two related documents, and it’s worth knowing which you’ve been asked for:
- Risk analysis — the assessment itself. Identifying what could go wrong, scoring likelihood and impact, and ranking the results. That’s this page.
- Risk management plan — the governing document that says how risks will be identified, who owns them, what the escalation thresholds are, and how they’re reported. It carries the risk register as an appendix.
In practice you do the analysis, and the plan is where the output lives. If your organization only asks for one document, it’s usually the plan — but it won’t be worth much unless the analysis behind it was done properly.
Finding the Risks
The hardest part, and the part most guidance skips. A scoring matrix is useless if the thing that actually goes wrong was never on the list.
Four methods, in rough order of how much they yield:
1. Assumption analysis. The most productive technique and the least used. Go through your plan and list every assumption it depends on — the supplier will deliver in four weeks, the team will be available in August, the data will migrate cleanly, approval will take a fortnight. Every assumption is a risk if it turns out to be wrong. Converting a plan’s assumptions into risks typically generates more real material than an hour of brainstorming.
2. A workshop with the people doing the work. Not just the managers. The person who will actually run the migration knows things about it that nobody above them does, and they’ll say so if asked directly and without consequence.
3. A category prompt list. Working through structured categories catches the risks nobody thought to raise. See the table below.
4. Lessons from last time. What went wrong on the previous three projects of this kind? If your organization keeps post-project reviews, they’re the best risk source you have. If it doesn’t, start — the risks that recur are the cheapest ones to prevent.
Category Prompt List
Work through each category and ask: what could go wrong here? Most teams find risks in at least four of these that hadn’t come up in general discussion.
| Category | Prompts |
|---|---|
| Technical | Untested technology, integration with existing systems, data quality, performance under load, security |
| People | Key person dependency, availability, skills gaps, turnover, resistance to the change |
| Commercial | Supplier failure or delay, price movement, contract terms, exchange rates, payment disputes |
| Organizational | Competing priorities, sponsor change, funding withdrawn, decisions delayed, restructuring |
| External | Regulation, weather, market conditions, public reaction, third-party dependencies |
| Legal & compliance | Licences and permissions, data protection, health and safety, contractual obligations, audit findings |
| Operational | Disruption to business as usual, capacity during transition, staff working two systems at once |
Qualitative Analysis
The everyday method, and right for most work. Each risk gets two scores, typically 1 to 5 — likelihood and impact — and multiplying them gives a number you can rank by. Our risk management plan page sets out the full 5×5 matrix and escalation bands.
Three things make qualitative scoring more reliable:
- Define the scale in words and numbers. “Impact 4 = cost impact above £25,000, or delay over one month.” Without written definitions, one person’s “major” is another’s “moderate” and the scores stop being comparable.
- Score impact against a stated objective. A risk can be minor for cost and severe for reputation. Either score the worst dimension or score them separately — but decide which, and be consistent.
- Score independently, then discuss. If the project manager scores first and everyone else agrees, you’ve measured the project manager. Ask people to score alone, then talk about the ones where you disagree — the disagreements are where the useful conversation is.
Quantitative Analysis: Putting Money on It
Where a decision hinges on cost — a contingency request, a go/no-go, a choice between options — qualitative scores aren’t enough. Somebody will ask how much.
The core technique is expected monetary value: the probability of a risk multiplied by its cost if it happens. A 30% chance of a £50,000 overrun has an EMV of £15,000. It isn’t a prediction of what any single risk will cost — it’s a way of comparing risks on a common scale and of totalling them into something usable.
| QUANTITATIVE RISK ANALYSIS | Warehouse system rollout | Prepared by K. Osei, September 2026 | ||||
| ID | Risk | Probability | Cost if it occurs | EMV |
|---|---|---|---|---|
| R01 | Trainer unavailable, delaying go-live by 4–6 weeks | 40% | 38,000 | 15,200 |
| R02 | Site B network upgrade slips past contract deadline | 30% | 52,000 | 15,600 |
| R03 | Stock data errors require manual correction post-launch | 20% | 18,000 | 3,600 |
| R04 | Supplier ceases trading during support period | 5% | 90,000 | 4,500 |
| R05 | Additional agency cover needed during parallel running | 60% | 14,000 | 8,400 |
| Total expected monetary value | 47,300 | |||
| Note: R04 has the largest potential cost but one of the smallest EMVs. It’s a transfer candidate (escrow, insurance) rather than a contingency item — low-probability, high-impact risks are poorly handled by averaging. | ||||
Two things this table shows that a qualitative score can’t. R02 outranks R01 on expected value despite being less likely, because the consequence is larger. And the note at the foot flags the limitation of the method: EMV averages, and averaging is the wrong tool for a rare catastrophe. A 5% chance of a £90,000 problem isn’t really a £4,500 problem — it’s either nothing or £90,000, and the right response is to transfer it rather than budget for the average.
Free Risk Analysis Templates in MS Word
Each template below is editable in Word. Define your scoring scales before you start — the definitions matter more than the format.
Project Risk Analysis Sheet
Here are our own created Word Templates for Risk Analysis to assist you.
Qualitative Risk Analysis Template
Qualitative Risk Assessment Tool
Risk Assessment Matrix
Risk Management Worksheet
Sizing Contingency
This is what a quantitative analysis is actually for, and it’s the strongest argument for doing one.
Most projects set contingency by adding a round percentage — 10% is the traditional figure — and defending it with nothing beyond convention. A risk analysis lets you say instead: “£47,300, built from these eleven risks, with the workings attached.”
That changes the conversation. A finance director can interrogate an assumption, challenge a probability, or accept a lower figure on stated grounds. A flat percentage can only be accepted or cut, and it’s usually cut, because there’s nothing in it to discuss.
Three practical points:
- Exclude risks you’ve transferred. If R04 is covered by an escrow arrangement or insurance, it shouldn’t also sit in the contingency figure.
- Separate contingency from management reserve. Contingency covers the risks you identified; reserve covers the ones you didn’t. Organizations differ on whether the project controls both — know which applies to you.
- Re-run it at each stage. As risks pass or materialise, the total changes. Contingency released back to the business at the end of a phase is one of the more persuasive things a project manager can do.
Once analysed, risks move into the register on your risk management plan, mitigations become dated tasks in an action plan, and the numbers feed the business case.
Common Analysis Mistakes
- Everything scores medium. If most of your risks land in the middle of the matrix, the scale isn’t discriminating and the analysis isn’t telling you anything. Force a ranking if you have to.
- Confusing likelihood with impact. “It would be catastrophic” is an impact statement; people frequently score it high on both because the consequence frightens them.
- Optimism bias. The team that owns the plan systematically underestimates the probability of its own plan going wrong. An outside view — someone who has done this before elsewhere — corrects more than any amount of internal discussion.
- Treating risks as independent. A supplier delay and a resource shortage often have the same underlying cause, and they arrive together. Averaging correlated risks understates the worst case considerably.
- Analysing once. An analysis done at kick-off and never revisited describes a project that no longer exists by month three.
- Scoring without definitions. Written scale definitions are what make two people’s scores comparable. Without them you’re collecting opinions in numerical clothing.
- Stopping at the score. The analysis is a means to a decision — what to mitigate, what to transfer, how much to set aside. A ranked list nobody acts on is an expensive afternoon.
Frequently Asked Questions
What is risk analysis?
The process of identifying what could go wrong, assessing how likely each thing is and how much it would matter, and ranking the results so that attention and money go to the risks that warrant them.
What is the difference between risk analysis and a risk management plan?
Risk analysis is the assessment — finding and scoring risks. The risk management plan is the governing document setting out how risks are identified, owned, escalated and reported, with the register attached. You do the analysis; the plan is where the result lives.
What is the difference between qualitative and quantitative risk analysis?
Qualitative scores likelihood and impact on a scale and ranks the results — fast, subjective, and adequate for most work. Quantitative puts monetary values on risks, usually through expected monetary value, and is used where a decision depends on cost.
What is expected monetary value?
Probability multiplied by the cost if the risk occurs. A 30% chance of a £50,000 overrun has an EMV of £15,000. Summing the EMVs across your risks gives a contingency figure you can justify line by line.
How do I identify risks in the first place?
Start with assumption analysis — every assumption in your plan is a risk if it’s wrong. Then run a workshop with the people doing the work, go through a category prompt list, and look at what went wrong on similar projects previously.
How do I work out how much contingency to hold?
Total the expected monetary values of your identified risks, excluding any you’ve transferred through insurance or contract. That gives a figure built from specific risks rather than a flat percentage, which is far easier to defend and far harder to cut arbitrarily.
What is a risk matrix?
A grid plotting likelihood against impact, usually five by five, with colour bands showing which scores require escalation. It turns two scores into a visual ranking and makes the priorities obvious at a glance.
How often should a risk analysis be repeated?
At every significant stage, and whenever something material changes. Probabilities shift as work progresses — a risk that was likely at the start may be impossible by the midpoint, and new ones appear that nobody could have listed at kick-off.
Pete Smith is a Business Management graduate and a passionate advocate for practical, accessible resources that empower professionals and entrepreneurs to succeed. With a strong foundation in organizational strategy and operational efficiency, Pete combines academic knowledge with real-world insights to simplify complex business processes. He is the creator behind a growing online platform dedicated to offering free, high-quality documents, templates, and actionable tips designed to save time and improve productivity.