Qualitative Risk Assessment
Definition
A methodology that rates likelihood and impact on descriptive or ordinal scales (such as 1-5 or low/medium/high) and combines them in a matrix to produce a risk priority. Fast to apply and accessible to non-technical stakeholders, but inherently subjective and not directly comparable to financial metrics.
- Scale type
- Descriptive or ordinal (e.g. low/medium/high)
- Output tool
- Risk matrix combining likelihood and impact
- Strength
- Fast, accessible to non-technical stakeholders
- Weakness
- Subjective, not directly comparable to financial metrics
Common questions
When would an organisation choose qualitative over quantitative risk assessment?+
Qualitative assessment suits early-stage or resource-constrained reviews where detailed loss data or probability figures are unavailable, or where the goal is a quick prioritisation of many risks rather than a precise financial justification for a specific control investment.
What is the main criticism investigators or auditors raise about qualitative risk matrices?+
Ratings like 'high' or 'medium' depend heavily on the individual assessor's judgement and can vary between reviewers assessing the same risk, and the matrix cannot be directly translated into a dollar figure needed to justify budget for mitigation.
Related terms
- ALE (Annualised Loss Expectancy)
- The expected monetary loss from a specific threat over a one-year period. Calculated as: ALE = SLE x ARO (Annualised Rate of...
- FAIR (Factor Analysis of Information Risk)
- A quantitative risk framework standardised by The Open Group (Open FAIR) that decomposes risk into Loss Event Frequency and Loss Magnitude, each...
- Quantitative Risk Assessment
- A methodology that assigns monetary values to threat scenarios using metrics such as asset value, exposure factor, SLE, ARO, and ALE. Outputs...
- Risk Appetite
- The amount and type of risk an organisation is willing to accept in pursuit of its objectives, as defined by its governing...
- SLE (Single Loss Expectancy)
- The expected monetary loss from a single occurrence of a specific threat event against a specific asset. Calculated as: SLE = Asset...