Use a risk matrix to sort many risks quickly, a semi-quantitative score when you need finer ranking, and FAIR style money ranges when a decision involves real budget and you have some data. Most programs use all three at different times, and none is correct for every question.
What each method is good at
NIST SP 800-30 describes three approaches. Qualitative methods use levels such as very low to very high and are good for communicating to decision makers, but the small range makes comparison inside a set of risks hard. Semi-quantitative methods use bins or scales, such as 0 to 100 or 1 to 10, which map to qualitative terms but still allow finer ranking. Quantitative methods use real numbers and best support cost benefit analysis, but can cost more in expert time and can be hard to interpret.
FAIR sits in the quantitative group and expresses risk in money.
A simple decision guide
- Rank 80 risks before the quarterly review: matrix or qualitative scale.
- Rank the top 15 with finer ordering: semi-quantitative score.
- Justify a large control purchase: money ranges.
- Choose between two big projects: money ranges.
- Show auditors you assess risk regularly: whatever method you apply consistently.
- Early design review with little data: qualitative with a few factors.
NIST notes that early in a system's life, threat and vulnerability information is vague and a qualitative assessment with few factors may be appropriate, while an assessment informed by control testing can support finer semi-quantitative values.
Where each one fails
A matrix compresses very different risks into the same cell. Two items shown as "high" can differ widely in cost. A semi-quantitative score can look exact when it is only a weighted guess. A money model can look precise while resting on thin inputs.
NIST says rigor drops when subjective calls are hidden inside numbers or when uncertainty is high. Whatever you choose, show the assumptions beside the result.
A practical path
- Start with a qualitative scale everyone can use in a workshop.
- Define each level in writing, with examples from your business.
- When a risk needs money to be discussed, quantify only that one.
- Keep the register in one format, with the method noted per entry.
This keeps the effort proportional to the decision. It also avoids the trap of spending a month modeling a risk that a ten minute fix would remove.
What leaders need to see
Leaders choose between options. Give them the risk, the range or rating, the proposed response, its cost, and what stays uncertain. If the method does not help them choose, change the method.
Quick check
Is a matrix wrong to use?
No. It is fast and easy to explain. It becomes a problem only when its output is treated as precise or when scale definitions are vague.
Can I mix methods in one register?
Yes, if you record which method produced each rating and convert to a common label for reporting.
Sources
Last reviewed: 19 October 2026.
