Qualitative risk analysis vs Quantitative risk analysis

Why they differ

The qualitative method uses scales and judgement; the quantitative one puts money and probabilities on each risk.

Risk management

Rating risks with words or simple scales, such as low, medium and high, based on judgement rather than exact figures.

Formal

A risk assessment method that scores likelihood and impact on ordered scales (for example 1-5 or low-high), usually by the judgement of people who know the systems, and often shows the result in a heat map.

In plain English

Like a mountain guide calling a slope "probably fine, but deadly if it slides" - quick and useful, even without an exact percentage.

In practice

The partners of an architect firm rate "a laptop with client drawings is left on the train" as medium likelihood and high impact, colour it orange on the chart and add one line on why.

Why it matters

It is fast, cheap and easy for leaders to read, but scores can hide guessing, so the reasons behind each rating should be written down.

Quantitative risk analysis

Risk management

Putting numbers on risks - how often a loss may happen and how much it would cost - to compare them in money.

Formal

A risk assessment method that estimates likelihood as a rate or probability and impact as a money amount, giving an expected yearly loss that can be weighed directly against the cost of a control or of insurance.

In plain English

Like deciding on an extended warranty for a washing machine - if a repair costs 2,000 and is needed once in five years, paying 800 a year for the warranty is a bad deal.

In practice

The finance team at a trucking company works out that a day without its planning system costs 400,000 kroner and happens about once every four years - an expected 100,000 a year - so a 60,000-a-year backup service that cuts such a day to an hour is worth buying.

Why it matters

Leaders understand money, and figures make it possible to compare security spending with other investments, though good data is often hard to find.

Shared connections

Impact Likelihood Risk Risk assessment