I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the design phase.

Could you please explain to me the difference between them?

  • 1
    Could you link a source for the distinction? Oct 24, 2015 at 9:14
  • 1
    If you google risk analysis vs risk assessment you will get 25 millions of results
    – user45139
    Oct 24, 2015 at 16:05

3 Answers 3


Risk analysis is part of the risk assessment. The risk assessment combines risk analysis and risk evaluation (the process used to determine risk management priorities by comparing the level of risk against predetermined standards).


Within the PMI risk management framework, Risk Assessment is qualitative, and risk analysis is quantitative.

I do risk assessment on all risks - are the frequency & impact high/medium/low? Is this similar to other risks? Have I expressed the risk formally?

I do risk analysis on only the top N% of risks (how I choose N is an entirely different essay). Risk Analysis dives deep to quantify the factors that affect the probability, impact, and other factors.


The two terms are often used interchangeably. Why do you believe a difference exists, and why do you need to worry about such difference? That is, there might be a standard you're following where there's some precision provided, and you need to pay attention.

Not the answer you're looking for? Browse other questions tagged .