**3.1. A review of classification criteria**

A commonly used criterion suggests looking at the nature of information that is available in a project. Qualitative and quantitative techniques are two fundamental groups applied to risk management. In the qualitative techniques risk assessment is connected with the determination of qualitative scales for evaluating the frequencies of occurrence of risky events and their impacts. They do not operate on numerical data but present results in the form of descriptions and recommendations basically according to opinions and risk tolerance boundaries collected from experts. The qualitative techniques are adopted to prioritise the identified risks for subsequent further action, such as quantitative risk analysis or response planning [1]. Moreover, they are used for determining highly risky areas in a short time, cheaply, and easily. At the other hand of the spectrum, quantitative techniques to support project risk management numerically analyse the effects of risks on overall project objectives in order to elaborate future trends [1,29]. They are applied to give an accurate image of risk that facilitates the cost and benefit analysis during the selection of reduction measures. However, the implementation of quantitative techniques is generally more expensive and requires greater experience than the application of qualitative techniques [30].

Another criterion is choosing techniques to support risk management according to the degree of knowledge about risk and the goal of the analysis. Kmec [27] discusses approaches to risk identification for the following situations: the majority of risks are known, the risks have been prioritised, the risk list is short, risks are classified according to some criteria, risks are broken down to build a hierarchy, relationships among risk are investigated, and risk evolution is studied overtime. Also, techniques for risk management differ according to whether the main aim is monitoring economic and financial outcomes, checking quality variance, tracking time delays or estimating the probability of the overall success or failure of a project.

70 Risk Management – Current Issues and Challenges

management levels.

"techniques".

**management** 

[30].

scope and range of application and allow a more appropriate use at various risk

How to select the correct practices and capture their actual potentialities is of paramount importance to enhance the knowledge that is necessary to manage in an effective and efficient manner the risk and the associated information throughout the development of a project. Such understanding facilitates a clear view of the critical conditions of a project, thus fostering performance improvement and enhancing trust within the project team [28].

The developed framework focuses on the need for a comprehensive perspective on the factors affecting risk investigation and proposes a taxonomy based on the most significant elements characterising the scenario in which project risk is approached. The aim is assisting in the choice of the appropriate practices according to the level and the purpose of the risk management effort. Since the distinction among the different terms to address risk management practices is not the purpose of this work, they are all referred to as

There are multiple aspects that can be considered when facing the decision about the appropriate techniques to be applied for the purpose of risk identification, assessment, or

A commonly used criterion suggests looking at the nature of information that is available in a project. Qualitative and quantitative techniques are two fundamental groups applied to risk management. In the qualitative techniques risk assessment is connected with the determination of qualitative scales for evaluating the frequencies of occurrence of risky events and their impacts. They do not operate on numerical data but present results in the form of descriptions and recommendations basically according to opinions and risk tolerance boundaries collected from experts. The qualitative techniques are adopted to prioritise the identified risks for subsequent further action, such as quantitative risk analysis or response planning [1]. Moreover, they are used for determining highly risky areas in a short time, cheaply, and easily. At the other hand of the spectrum, quantitative techniques to support project risk management numerically analyse the effects of risks on overall project objectives in order to elaborate future trends [1,29]. They are applied to give an accurate image of risk that facilitates the cost and benefit analysis during the selection of reduction measures. However, the implementation of quantitative techniques is generally more expensive and requires greater experience than the application of qualitative techniques

Another criterion is choosing techniques to support risk management according to the degree of knowledge about risk and the goal of the analysis. Kmec [27] discusses

**3. Dimensions for selecting techniques to support project risk** 

control. They will be widely explained in the following sections.

**3.1. A review of classification criteria** 

In addition, risk management practices can be distinguished based on how the investigation is performed. Gidel and Zonghero [31] focus on selected techniques and suggest when they are suitable depending whether an analogical, heuristic, or analytic approach is applied to risk identification. With an analogical approach the study of risk mainly relies on the experience coming from the management of previous and similar projects. The heuristic approach uses the project team creativity or expertise through for instance brainstorming sessions. Finally, the analytic approach is typically based on FMEA and Fault Tree Analysis and aims to decompose a system to identify risky events for each sub-system together with their causes and effects.

Also, the nature, size, and phase of the life cycle of a project as well as the kind of associated consequences determine which techniques to support risk management should be used. Some authors highlight that, although risk management should assist in the entire life cycle of a project, it is particularly crucial in the planning stage and its scope and depth increase as the project moves towards the execution phase, while they decrease in the termination phase [13,32]. As a matter of fact, the earlier the risks are identified, the more realistic the project plan and the expectation of results and the more effective the contingency plans both during the development of the project and beyond [1,33].

Other works focus on the strong correlation between the risk profile of a project and its organisation: for instance, different procurement schemes require different risk practices [22].

Furthermore, every single step of managing risks, whether identifying or assessing them, developing response plans, or monitoring their execution, implies a different level of information and detail, thus it requires the application of different techniques. Literature reports numerous classifications of techniques according to the phase of risk management for which they are most suitable [1,34,35].

Finally, the project risk management capabilities of an organisation improve as its risk culture increases. A scarce awareness towards risk drives occasional applications of informal risk techniques to specific projects and problems are dealt with only when they show up. Recognising the relevance of risk, instead, is the condition for proactively managing uncertainty [33,36,37]. As a consequence, techniques supporting risk management require different levels of corporate risk maturity in order to yield the expected benefits and this constitutes a criterion according to which risk techniques may be classified [25].
