The risk assessment is only as good as the model on which it is built.
The model is built through a process of gathering stakeholders, identifying risks and opportunities, estimating the potential impact and selecting risks and opportunities for quantification.
The quantification process must be disciplined and deliberate.
Whether you are doing a cost risk assessment, a schedule risk assessment or a combined risk assessment, the process is straightforward. This process is called ranging. When you range a risk, you assign typically three numeric values to the risk: Optimistic, Pessimistic, and Most Likely. For a cost risk, the range might be expressed in dollars or in percentages. In a schedule risk exercise, the range will likely be expressed in days, but can also be a percentage.
Risk assessment is becoming an industry standard. Unfortunately, at this point that is the only standard part of the process. Unlike, say, the field of medicine, you don’t need a license to be a risk practitioner in project management. However, there are a few certifications in the industry that, at the very least, will guarantee a baseline of knowledge and experience.
The Project Management Institute grants a credential called the Risk Management Professional (PMI-RMP). In order to qualify to sit for the exam, a professional must have completed at least 3,000 hours of risk practice. Then they must pass the exam, which is quite comprehensive, in order to get the credential.
In order to maintain the credential, the professional must participate in ongoing education.
AACE International offers a Decision Risk Management Professional designation, which is well regarded in the industry.