thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Governance, Risk, Audit & Privacy

Qualitative vs Quantitative Risk Analysis: What's the Difference?

Qualitative risk analysis ranks risks using subjective ratings such as high, medium, and low, often in a heat map. Quantitative risk analysis assigns numeric monetary values using formulas such as SLE = AV x EF and ALE = SLE x ARO.

Qualitative Risk Analysis

Full definition
vs

Quantitative Risk Analysis

Full definition
Qualitative Risk AnalysisQuantitative Risk Analysis
OutputRatings (High/Medium/Low), heat mapsDollar values and probabilities
SpeedFast, inexpensiveSlow, data intensive
ObjectivitySubjective, expert judgmentMore objective, but only as good as the data
Key formulasNone, uses scalesSLE = AV x EF; ALE = SLE x ARO
Best forInitial screening, hard-to-quantify risks like reputationCost/benefit analysis of safeguards
TechniquesDelphi technique, interviews, workshopsMonte Carlo simulation, statistical analysis
Remember it

Qualitative uses words; quantitative uses dollars.

Exam tip

Be ready to calculate ALE and decide whether a control is cost-justified: a safeguard is worth it when ALE before minus ALE after minus annual control cost is positive.

Tested on

More Governance, Risk, Audit & Privacy look-alikes