Which statement best describes the difference between qualitative and quantitative risk assessment?

Which statement best describes the difference between qualitative and quantitative risk assessment?

• A. Qualitative uses numerical scores; quantitative uses subjective opinions.
• B. Qualitative uses subjective ratings; quantitative assigns numerical scores (probability x impact) to estimate risk levels and prioritize controls.
• C. Qualitative is only about probability; quantitative ignores impact.
• D. Qualitative and quantitative risk assessment are the same.

Answer: (C)

The main idea is how risk assessments are measured: qualitative relies on subjective judgments to rate both how likely a risk is and how severe its impact could be, usually using categories like low/medium/high. Quantitative uses numerical values for both probability and impact (often multiplying them to get a numeric risk level) to prioritize controls and allocate resources. That’s why the best statement is that qualitative uses subjective ratings, while quantitative assigns numerical scores (probability × impact) to estimate risk levels and prioritize controls. The alternative claiming qualitative is only about probability and that quantitative ignores impact isn’t accurate, because qualitative also considers impact in qualitative terms, and quantitative explicitly uses both probability and impact with numbers. The idea that qualitative and quantitative risk assessment are the same is simply false.

The main idea is how risk assessments are measured: qualitative relies on subjective judgments to rate both how likely a risk is and how severe its impact could be, usually using categories like low/medium/high. Quantitative uses numerical values for both probability and impact (often multiplying them to get a numeric risk level) to prioritize controls and allocate resources.

That’s why the best statement is that qualitative uses subjective ratings, while quantitative assigns numerical scores (probability × impact) to estimate risk levels and prioritize controls. The alternative claiming qualitative is only about probability and that quantitative ignores impact isn’t accurate, because qualitative also considers impact in qualitative terms, and quantitative explicitly uses both probability and impact with numbers. The idea that qualitative and quantitative risk assessment are the same is simply false.