The information security manager is assessing risk for a new line of business. There is little reliable historical loss data and no industry benchmarks for the scenarios involved. Which approach is MOST appropriate?

Quantitative analysis is only as credible as its inputs. When reliable loss history and benchmarks are absent, a qualitative assessment using defined, documented scales for likelihood and impact, applied through structured judgement with business stakeholders, produces a consistent and defensible ranking of risks that management can act on. The definitions keep ratings comparable across scenarios and over time, and the method can evolve toward quantification as data accumulates. A quantitative calculation built from estimated figures creates false precision: annualized loss figures look authoritative but rest on guesses, which can mislead decision makers about certainty. Deferring the assessment until data exists leaves the new business operating with unassessed risk, possibly for years, which is not an acceptable governance outcome. Borrowing ratings from a different industry imports assumptions about threats, controls and impacts that do not reflect this business and its appetite. Exam caveat: semi-quantitative approaches, which assign numbers to qualitative scales, are also legitimate, but they do not remove the need for agreed definitions. Operational check: confirm the scales are documented, approved by management and applied consistently, and that participants and rationale for each rating are recorded.