As part of this qualitative analysis, the risks must be classified by their root cause as well as by the common effects. Looking at the most important root causes and common effects will help to drive mitigation efforts.
Each risk must be assessed according to probability of occurrence.
This qualitative analysis should be done on periodical basis throughout the project as the information to analyse risks will be more and different as the project moves forward.
The deliverable of this process is a contribution to the risk register document; it adds information like impact, probability and priority to every identified risk. Typically, the high priority risks will be analysed in detail and monitored frequently while the low priority ones will placed in a watched list and reviewed less often.
Notes taken during my study of "Practice standard for Project Risk Management" from PMI