Quantitative Risk Assessment
Definition
A methodology that assigns monetary values to threat scenarios using metrics such as asset value, exposure factor, SLE, ARO, and ALE. Outputs are in currency, making them directly comparable to control costs and enabling cost-benefit analysis.
- Key formula
- SLE x ARO = ALE
- Output unit
- Currency (monetary value)
- Contrasts with
- Qualitative risk assessment
- Core inputs
- Asset value, exposure factor, ARO
Common questions
How does quantitative risk assessment differ from qualitative risk assessment?+
Qualitative methods rank risk on scales like low, medium or high using expert judgment, while quantitative methods assign dollar figures to each variable, letting the analyst compare risk reduction directly against control cost.
What is the main limitation of quantitative risk assessment?+
It depends on reliable historical loss data and accurate probability estimates. For rare or novel threats these figures are often little more than educated guesses, which can lend false precision to the output.
Related terms
- ALE (Annualised Loss Expectancy)
- The expected monetary loss from a specific threat over a one-year period. Calculated as: ALE = SLE x ARO (Annualised Rate of...
- FAIR (Factor Analysis of Information Risk)
- A quantitative risk framework standardised by The Open Group (Open FAIR) that decomposes risk into Loss Event Frequency and Loss Magnitude, each...
- Qualitative Risk Assessment
- A methodology that rates likelihood and impact on descriptive or ordinal scales (such as 1-5 or low/medium/high) and combines them in a...
- Risk Appetite
- The amount and type of risk an organisation is willing to accept in pursuit of its objectives, as defined by its governing...
- SLE (Single Loss Expectancy)
- The expected monetary loss from a single occurrence of a specific threat event against a specific asset. Calculated as: SLE = Asset...