Risk Analysis and Evaluation (Qualitative and Quantitative)
Qualitative analysis
Qualitative analysis prioritises risks using probability (likelihood) and impact (consequence), often via a probability-impact matrix producing a risk score or rating (e.g. low/medium/high). It is fast, subjective and used to screen risks for further action. Risk proximity (how soon), velocity (how fast it escalates), manageability and detectability may also be considered. Beware: a matrix score is a ranking aid, not a precise measurement - 4×4 is not "twice as bad" as 2×4.
Quantitative analysis
Quantitative techniques assign numerical values and model uncertainty: expected monetary value (EMV = probability × impact), decision trees, Monte Carlo simulation, sensitivity analysis (tornado diagrams), PERT/three-point estimating, and contingency/reserve calculation. Quantitative analysis is more rigorous but needs reliable data and effort.
Evaluation
Evaluation compares analysed risk against criteria and tolerance to decide what needs a response, what can be accepted, and what must be escalated. It answers: is this acceptable, and who must act?
Traps
- Treating a matrix score as an absolute, objective value.
- Forgetting that EMV gives an average outcome, not a guarantee.
- Ignoring proximity - a low-impact risk happening tomorrow may matter more than a high-impact one next year.
Worked example
Risk A: 20% chance of £100k loss → EMV = £20k. Risk B: 60% chance of £40k loss → EMV = £24k. Despite lower impact, B has the higher expected exposure and may warrant priority. Summing EMVs of independent risks gives an indicative contingency reserve.
Rule of thumb
Qualitative first to screen; quantitative where data and stakes justify it. Never confuse a score with a certainty.