What is qualitative risk analysis?
Qualitative risk analysis judges risks with descriptive ratings instead of money. Each risk gets a likelihood rating and an impact rating on an agreed scale, such as rare to almost certain and negligible to severe, and the combination places it in a band such as low, medium, high or critical. The ratings come from the judgment of people who know the systems and the business, informed by incident history, threat intelligence and scan results. The goal is a defensible ranking that shows which risks deserve attention first.
How it works
Before anything is rated, the organization writes down what each level means, so that two managers rating the same risk mean the same thing. A three-level scale of low, medium and high is quick; a five-level scale gives more separation. Many organizations give the levels numbers and multiply them, so a likelihood of 4 and an impact of 3 scores 12. Those numbers are ordinal: they show order, not quantity, so a 12 doesn't mean double the risk of a 6.
Results are usually shown on a risk matrix, often called a heat map, with likelihood along one axis, impact along the other and cells shaded from green to red. Risks in the red corner go to senior management first.
Ratings can be gathered through interviews, workshops or surveys. The Delphi technique asks a panel of experts for anonymous ratings over several rounds, sharing a summary after each round, until the estimates settle. Anonymity keeps the most senior or loudest person from setting everyone's score.
Example: rating three risks
| Risk | Likelihood | Impact | Result |
|---|---|---|---|
| Ransomware through a phished account | Likely (4) | Severe (5) | 20, critical |
| Laptop lost on a business trip, disk encrypted | Possible (3) | Minor (2) | 6, medium |
| Data center flood | Rare (1) | Severe (5) | 5, medium |
Ransomware tops the list. The lost laptop rates only minor impact because full-disk encryption keeps its data unreadable, which is how existing controls lower a rating. The flood is unlikely but would be devastating, so some organizations add a rule that any risk at the highest impact level goes to management regardless of its total score.
Strengths and weaknesses
- Fast: a whole risk register can be rated in a few workshops.
- Works without loss data: useful for new systems and rare events with no history.
- Easy to communicate: executives understand a red cell without a finance background.
- Subjective: ratings depend on who is in the room, and optimism or fear can skew them.
- No cost-benefit answer: a high rating doesn't say whether a $50,000 control is worth buying.
Qualitative vs. quantitative risk analysis
Quantitative risk analysis expresses the same risks in money, using single loss expectancy, annualized rate of occurrence and annualized loss expectancy. It can answer cost-benefit questions but needs credible figures and takes much longer. Organizations commonly run both, giving every risk a quick rating and calculating dollar values only where a budget decision rides on the number. Impact scales defined by dollar bands, such as impact 4 meaning $1 million to $5 million, are a hybrid of the two, often called semi-quantitative.
Qualitative risk analysis on the CompTIA Security+ exam
Qualitative analysis is part of SY0-801 objective 5.2. Scenario wording that points to it includes rating risks as high, medium or low, placing them on a heat map or matrix, or relying on expert judgment because no loss figures exist. If the scenario mentions dollars per year, SLE, ARO or ALE, the method is quantitative instead. Remember the trade-off the exam likes to test: qualitative analysis is faster and easier to communicate, while quantitative analysis supports cost-benefit decisions.