Before spending time & money on mitigating a risk, did you do proper analysis to provide concrete, tangible, measurable information that will support your decisions?
Risk analysis focuses on attaining the details related to the risk events.  One method is to focus on the process of determining probability and impact of the risk.  This information forms the basis of how risks are analyzed, prioritized, ranked and ultimately responded to. 


The two main parameters to always know are PI (probability and impact).  However, additional ones also include: Cause, Timing, Frequency and Alternatives.

See video below for an explanation on what the tool/acronym PICTA stands for:


Try to remember the word PICTA - Probability, Impact, Cause, Timing/frequency, Alternatives.  
Keep that in your back pocket at all times to help focus on key parameters of risk analysis.


Supporting details related to the two key parameters are included below: 

Qualitative risk analysis should follow a systematic approach to identify:
  • Probability – the likelihood that the risk event will occur.  The probability should be assigned a numeric value.  The definition or scale must be detailed enough that there is no misunderstanding by stakeholders.  The scale may range from 0 (will not occur) to 0.5 (in the middle, may or may not occur and has an equal change for each) to 1 (certainty that it will occur).  It may also help to draw a scale (people can then visualize it).  
  • Impact – this reflects the magnitude of the consequence how the project will be affected if the risk event occurs.  This must be assessed by the team with a focus on the project as a whole (generally the objectives should be reviewed and compared to the types of consequences that could occur).  More detailed impact analysis could be done later in the risk planning stages with a focus on a more specific area (e.g. scope, time, cost, quality, training, etc) but this should follow a more customized risk management approach with specific resources assigned.  Similar to the probability scale, the  impact scale definition must be detailed enough that there is no misunderstanding by stakeholders.  Generally the scale will have a column that assigns the impact a numeric value and also a column with a definition. 
An example includes:

Impact Value
Impact Level
Definition
1
Low
Impact will be minor and not noticeable outside the project team
3
Medium
Impact will influence the plans of the project, corrective actions will be taken, active response planning will be required
5
High
Impact is major and stakeholders outside the project team will need to be immediately involved

Once the probability and the impact guidelines have been created in a standardized and consistent format, a matrix can be built to prioritize risks based on the combination of the two factors.  

For additional details on a risk matrix approach using PI, see a journal paper at the link below:
scientificpapers-risk-analysis