Qualitative and Quantitative Risk Assessment
Measuring risk on scales or in money
Qualitative risk assessment uses descriptive scales such as high, medium and low, supported by the expert judgment of people who know the business, which makes it quick to apply but hard to compare objectively across different risks, while quantitative assessment expresses risk in numerical terms, typically as expected annual financial loss, using methodologies such as FAIR that combine the estimated frequency of an event with the magnitude of its economic impact. Neither approach is universally better: qualitative assessment is more accessible and sufficient for prioritizing risks in most organizational contexts, while quantitative assessment is valuable when you need to justify a specific security investment to leadership by comparing the cost of the control with the expected loss it prevents. In practice, many mature organizations combine both approaches, using qualitative assessment for the initial sweep of risks and reserving quantitative analysis for the few most critical risks where a defensible figure is needed for the executive committee.