Guide for Conducting Risk Assessments
CHAPTER 2 > 2.3.2 Assessment Approaches

2.3.2 Assessment Approaches

Risk, and its contributing factors, can be assessed in a variety of ways, including quantitatively,
qualitatively, or semi-quantitatively. Each risk assessment approach considered by organizations
has advantages and disadvantages. A preferred approach (or situation-specific set of approaches)
can be selected based on organizational culture and, in particular, attitudes toward the concepts of
uncertainty and risk communication. Quantitative assessments typically employ a set of methods,
principles, or rules for assessing risk based on the use of numbers-where the meanings and
proportionality of values are maintained inside and outside the context of the assessment. This
type of assessment most effectively supports cost-benefit analyses of alternative risk responses or
courses of action. However, the meaning of the quantitative results may not always be clear and
may require interpretation and explanation-particularly to explain the assumptions and
constraints on using the results. For example, organizations may typically ask if the numbers or
results obtained in the risk assessments are reliable or if the differences in the obtained values are
meaningful or insignificant. Additionally, the rigor of quantification is significantly lessened
when subjective determinations are buried within the quantitative assessments, or when
significant uncertainty surrounds the determination of values. The benefits of quantitative
assessments (in terms of the rigor, repeatability, and reproducibility of assessment results) can, in
some cases, be outweighed by the costs (in terms of the expert time and effort and the possible
deployment and use of tools required to make such assessments).
In contrast to quantitative assessments, qualitative assessments typically employ a set of methods,
principles, or rules for assessing risk based on nonnumerical categories or levels (e.g., very low,
low, moderate, high, very high). This type of assessment supports communicating risk results to
decision makers. However, the range of values in qualitative assessments is comparatively small
in most cases, making the relative prioritization or comparison within the set of reported risks
difficult. Additionally, unless each value is very clearly defined or is characterized by meaningful
examples, different experts relying on their individual experiences could produce significantly
different assessment results. The repeatability and reproducibility of qualitative assessments are
increased by the annotation of assessed values (e.g., this value is high because of the following
reasons) and by the use of tables or other well-defined functions to combine qualitative values.
Finally, semi-quantitative assessments typically employ a set of methods, principles, or rules for
assessing risk that uses bins, scales, or representative numbers whose values and meanings are not
maintained in other contexts. This type of assessment can provide the benefits of quantitative and
qualitative assessments. The bins (e.g., 0-15, 16-35, 36-70, 71-85, 86-100) or scales (e.g., 1-10)
translate easily into qualitative terms that support risk communications for decision makers (e.g.,
a score of 95 can be interpreted as very high), while also allowing relative comparisons between
values in different bins or even within the same bin (e.g., the difference between risks scored 70
and 71 respectively is relatively insignificant, while the difference between risks scored 36 and 70
is relatively significant). The role of expert judgment in assigning values is more evident than in a
purely quantitative approach. Moreover, if the scales or sets of bins provide sufficient granularity,
relative prioritization among results is better supported than in a purely qualitative approach. As
in a quantitative approach, rigor is significantly lessened when subjective determinations are
buried within assessments, or when significant uncertainty surrounds a determination of value. As
with the nonnumeric categories or levels used in a well-founded qualitative approach, each bin or
range of values needs to be clearly defined and/or characterized by meaningful examples.
Independent of the type of value scale selected, assessments make explicit the temporal element
of risk factors. For example, organizations can associate a specific time period with assessments
of likelihood of occurrence and assessments of impact severity.