This question already has an answer here:

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the design phase.

Could you please explain to me the difference between them?

marked as duplicate by Lucas Kauffman, user45139, Neil Smithline, Xander, schroeder Oct 24 '15 at 17:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Could you link a source for the distinction? – StackzOfZtuff Oct 24 '15 at 9:14
  • 1
    If you google risk analysis vs risk assessment you will get 25 millions of results – user45139 Oct 24 '15 at 16:05

Risk analysis is part of the risk assessment. The risk assessment combines risk analysis and risk evaluation (the process used to determine risk management priorities by comparing the level of risk against predetermined standards).


Within the PMI risk management framework, Risk Assessment is qualitative, and risk analysis is quantitative.

I do risk assessment on all risks - are the frequency & impact high/medium/low? Is this similar to other risks? Have I expressed the risk formally?

I do risk analysis on only the top N% of risks (how I choose N is an entirely different essay). Risk Analysis dives deep to quantify the factors that affect the probability, impact, and other factors.


The two terms are often used interchangeably. Why do you believe a difference exists, and why do you need to worry about such difference? That is, there might be a standard you're following where there's some precision provided, and you need to pay attention.

Not the answer you're looking for? Browse other questions tagged or ask your own question.