Which of the following is the MOST likely reason to perform a qualitative risk analysis?

Qualitative risk analysis is primarily used when a quick, cost-effective assessment is needed, or when reliable numerical data for a quantitative analysis is unavailable. It uses descriptive scales (e.g., high, medium, low) and expert judgment to prioritize risks. This approach is ideal for gaining a high-level, initial understanding of the risk landscape, including dependencies and interactions between business units, without the significant time and expense required for a detailed quantitative analysis. It helps focus resources on the most critical areas first.

B: Meaningful risk aggregation for an enterprise view typically requires quantitative data to combine diverse risks in a consistent and comparable financial manner. C: Comparing the value of benefits to the cost of a response is a cost-benefit analysis, which is an inherently quantitative technique requiring monetary values.

1. ISACA, The Risk IT Framework, 2nd Edition, 2020, Process AP012: Manage Risk, p. 44. The framework distinguishes between qualitative and quantitative analysis, noting that qualitative analysis is often used for an initial screening of risks.

2. ISACA, CRISC Review Manual, 6th Edition, 2015, Chapter 2: IT Risk Assessment, p. 87. The manual states that qualitative assessments are "quick to perform" and are useful for "creating a 'short list' of the most significant risks."

3. Carnegie Mellon University, Software Engineering Institute, "OCTAVE Allegro Information Sheet," 2007. This document describes a qualitative risk assessment methodology designed to be performed quickly by a small team to understand an organization's information security risks.