Dependencies and interdependencies between major risks are becoming a critical issue for large engineering projects. Current project risk analysis and management (PRAM) process does not focus effectively on relationships between risks, even though risks are often not independent in complex projects. As a consequence, we develop a risk dependency analysis (RDA) procedure to support PRAM. It entails three phases: Dependency Identification, Dependency Assessment, and Dependency Quantification. The aim of Dependency Identification is to describe risk dependencies and interdependencies through a design structure matrix (DSM) and gather them in clusters. Dependency Assessment is an unconventional probabilistic approach, which considers risk dependencies as events with their own probabilities, while Dependency Quantification estimates the impact of risk dependencies on project performance. The application of RDA to the Oil & Gas Industry uses a Monte Carlo simulation model, which aims at estimating schedule delays and capital expenditure (CAPEX) overruns.