I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the design phase.
Could you please explain to me the difference between them?
Risk analysis is part of the risk assessment. The risk assessment combines risk analysis and risk evaluation (the process used to determine risk management priorities by comparing the level of risk against predetermined standards).
Within the PMI risk management framework, Risk Assessment is qualitative, and risk analysis is quantitative.
I do risk assessment on all risks - are the frequency & impact high/medium/low? Is this similar to other risks? Have I expressed the risk formally?
I do risk analysis on only the top N% of risks (how I choose N is an entirely different essay). Risk Analysis dives deep to quantify the factors that affect the probability, impact, and other factors.
The two terms are often used interchangeably. Why do you believe a difference exists, and why do you need to worry about such difference? That is, there might be a standard you're following where there's some precision provided, and you need to pay attention.
