Use qualitative scoring (high, medium, low) when you need to rank many risks quickly and data is thin. Use quantitative analysis (estimated loss in money, with ranges) for a few large decisions, such as a budget request or an insurance choice. Most teams should do the first broadly and the second selectively.
What each approach gives you
Qualitative assessment sorts risks on a scale. Someone rates likelihood and impact, and the product gives a rank. It is quick, workshop friendly and easy to explain.
Quantitative assessment estimates how often a loss event could happen and how much it could cost, usually as ranges instead of single numbers. It lets you compare a control's cost with the loss it avoids.
Where each one breaks
Qualitative scores drift. One person's "high" is another's "medium," and a five by five matrix tends to cluster everything in the middle. Two risks with the same color can differ by a factor of ten in real cost, and the chart hides it.
Quantitative work can look more precise than it is. If the inputs are guesses, the output is a guess with decimals. Without internal loss data, you rely on expert estimates, and those need to be given as ranges with stated confidence.
A mixed approach that works
- Run a qualitative pass across the full risk register to find the top ten.
- For those ten, ask the owners for low, likely and high estimates of frequency and cost.
- Compare your estimates with the cost of the proposed fix.
- Record the assumptions next to each number so a reviewer can challenge them.
Calibrate your estimators. A simple test is to ask people for ranges they are ninety percent sure about on questions with known answers. Most people are overconfident at first, and a little practice narrows the gap.
What to show leadership
Executives usually want a short comparison, not a model. Show the top risks, a range for each, the proposed action and what it costs. If you cannot defend a number, show a range or say it is an estimate. A board that sees honest uncertainty tends to trust the rest of your report.
NIST guidance on risk assessment is explicit that assessment results exist to help senior leaders choose responses, which means the format should serve that choice, not the method.
Quick check
Is quantitative risk analysis always better?
No. It needs usable inputs and effort. For a long list of minor risks, qualitative ranking is faster and good enough.
Can I use both?
Yes. Rank everything qualitatively, then quantify the few risks that drive large spending decisions.
Sources
Last reviewed: 19 October 2026.
