What is the PRIMARY difference between qualitative and quantitative risk analysis?

The primary distinction between the two risk analysis methods lies in the nature of the data used. Qualitative risk analysis is subjective, relying on expert judgment, experience, and descriptive scales (e.g., high, medium, low) to assess the probability and impact of risks. It prioritizes risks for further action. In contrast, quantitative risk analysis is objective and uses numerical data to assign a specific monetary value to risk. It employs mathematical formulas to calculate metrics like Annualized Loss Expectancy (ALE), providing a concrete financial figure to inform decision-making and cost-benefit analysis.

A. Qualitative risk analysis is based on subjective judgment and descriptive scales, not objective, measurable data.

C. This option incorrectly reverses the definitions; qualitative analysis uses descriptive terms, not numerical data.

D. This option also incorrectly reverses the definitions; quantitative analysis is based on numerical data, not subjective opinion.

1. NIST Special Publication 800-30 Revision 1

Guide for Conducting Risk Assessments.

Section 2.3.1 (Qualitative Risk Assessment): Describes this method as using "descriptive terms or numeric values on a representative scale" and notes that it "depends on the expertise and experience of the individuals conducting the assessment." This supports the subjective nature.

Section 2.3.2 (Quantitative Risk Assessment): Defines this method as assessing risk "based on the use of numbers... where the values of the risk factors and the risk itself are expressed as specific

measurable quantities." This supports the numerical basis.

2. ISO/IEC 27005:2022

Information security

cybersecurity and privacy protection — Guidance on managing information security risks.

Section 8.3.2 (Risk analysis methodologies): This section explicitly contrasts the two approaches

stating that a qualitative approach uses scales of "qualitative attributes (e.g. low

medium

high)" to describe consequence and likelihood. It describes a quantitative approach as one that uses numerical scales for consequence and probability.

3. Hubbard

D. W.

& Seiersen

R. (2016). How to Measure Anything in Cybersecurity Risk. John Wiley & Sons.

Chapter 3

"The Limits of Expert Knowledge": This chapter discusses how qualitative methods rely on subjective expert intuition

which can be inconsistent. It contrasts this with quantitative methods that use "calibrated estimates and mathematical models" to produce objective

numerical results like probabilities and loss expectancies.