A risk team rates each identified risk as high, medium, or low for both likelihood and impact and plots the results on a heat map. No monetary values are assigned. Which type of risk analysis is the team performing?
Select an answer to reveal the explanation.
Short Explanation
High, medium, low is the language of judgment, not dollars, so you're in qualitative territory. Quantitative means numbers you can put on an invoice, like SLE and ALE. Don't let the heat map fool you; plotting labels on a grid still isn't a calculation.
Full Explanation
Qualitative risk analysis uses descriptive scales, such as high, medium, and low or a one-to-five rating, to estimate likelihood and impact based on expert judgment. Combining the two ratings on a matrix or heat map lets the organization rank risks and focus attention quickly without the effort of gathering financial data. The absence of monetary values in the scenario is the deciding factor. Quantitative risk analysis assigns numeric, usually financial, values: asset value, exposure factor, single loss expectancy, annualized rate of occurrence, and annualized loss expectancy. It supports cost-benefit decisions about controls but requires reliable data the team has not used. A business impact analysis identifies critical business processes and the effects of their disruption over time, producing recovery objectives such as RTO and RPO; it is related to risk work but answers a different question than rating each risk's likelihood. A control gap analysis compares current controls with a target framework or standard to find missing requirements; it does not score risks by likelihood and impact. Exam caveat: many programs use a hybrid approach, starting qualitatively and applying quantitative analysis to the top-ranked risks. Operational check: confirm the rating criteria are written down, for example what makes impact high, so different assessors score the same risk consistently.