Qualitative risk analysis

Qualitative analysis stands or falls with its scale definitions, which ISO 31000:2018 and ISO/IEC 27005:2022 treat as part of the risk criteria agreed before any scoring. Each level needs an anchored descriptor, not a bare word: likelihood tied to frequency bands or expected occurrences over a time window, consequence tied to thresholds per impact type, such as revenue lost, hours of outage, records exposed or regulatory sanction. Without anchors, "likely" is read very differently by different people; research on verbal probability expressions, going back to Sherman Kent's work on estimative language at the CIA, shows wide spread in the numeric probability people attach to the same word.

NIST SP 800-30 Rev. 1 gives the most detailed public template. Appendix D rates adversarial threat sources on capability, intent and targeting; Appendix G builds overall likelihood from the likelihood of a threat event being initiated or occurring and the likelihood of it resulting in adverse impact; Appendix H covers impact; and Appendix I combines the two into a risk level. Each scale has five levels, Very Low to Very High, with optional semi-quantitative equivalents on a 0-100 or 0-10 range. Semi-quantitative scoring is still ordinal judgement expressed as numbers, and arithmetic on it inherits the weaknesses of heat-map multiplication.

Reliability depends on process. Scores should come from people who know the systems and the business, ideally scored independently first and then discussed, as in a Delphi round, so that anchoring on the most senior voice is reduced. Recording a confidence level and a one-line rationale per rating makes later review possible and exposes guessing. Consistency across business units requires shared scales and occasional calibration sessions where teams score the same reference scenarios.

The method's strengths are speed, low data requirements and output that leaders read easily, which is why most ISO/IEC 27001 risk assessments are qualitative. Its limits are equally clear: ratings cannot be added across risks, cannot be compared directly with the cost of a control, and invite false precision when averaged or multiplied. A common hybrid is to screen the whole register qualitatively and then move the handful of risks tied to large investment or insurance decisions into quantitative analysis, where likelihood and impact are expressed as probability distributions and money.